Responsibilities Kforce is immediately seeking an experience Splunk Consulting Engineer in support of our enterprise networking and cloud solutions client in Milpitas, CA. Project requirements: • Splunk Consulting Engineer will assist in migration of the security/observability logging solution in Webex Contact Center Enterprise (WxCCE) production environment from Exabeam to Splunk Cloud Enterprise Security Secure Information Event Management (SIEM) system • Lead and/or assist with deployment of Splunk Universal and Heavy forwarders in VMware in Company private data centers • Validate the appropriate data ingestion in Splunk Cloud from Company data centers for all data types, i.e. routers, switches, firewalls, terminal servers, Linux & Windows OS nodes, and other infrastructure and application elements • Perform the initial baseline configuration of Splunk ES with the plays/playbooks based on the ingested data types, data volume, data locality (regions), and application call flow • As a Splunk Consulting Engineer, you will create the baseline configuration documentation for Splunk ES • Provide continuous data analytics and playbook configuration and documentation of the Splunk Cloud platform • Development of Splunk ES playbooks aligned with the MITRE ATT&CK framework • Supports the hands-on engineering activities for performance and stability, and adhere to the change management process • Document all the technical functions in alignment with the published Company standards, processes, and practices • Produce metrics for platform performance, capacity, and user management • Analyze and identify risks associated with Splunk Core and ES configurations and ingested data Requirements • Experience working with Splunk APIs and integration of other cloud/on-premise API endpoints using python, ansible, salt, and other tools • Experience working with bash, batch scripts • Experience deploying/managing Splunk indexer clusters and search head clusters • Deployment experience with migrating brown-field 3rd party SIEM deployments to Splunk Cloud SIEM • Strong Linux & Windows system administration and engineering skills; Hands-on experience with administering servers from the command line and working with configuration files • Hands-on experience deployment Splunk add-ons, Agents, Universal and Heavy forwarders in VMware and OpenStack • Experience with integrations with ServiceNow, JIRA, and other ITSM solutions • Deep hands-on knowledge of Splunk Enterprise and Splunk Enterprise Security (ES) Cloud products. • Deep knowledge of the Splunk query language The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future. We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave. Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law. This job is not eligible for bonuses, incentives or commissions. Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status. By clicking “Apply Today” you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.