Splunk SME_ Remote
Contract
Required Qualifications'
Bachelor s degree in computer science, Information Systems, Cybersecurity, or equivalent professional experience
5-8+ years of hands-on Splunk experience in enterprise environments
3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day)
Deep expertise in Splunk Enterprise Security correlation search authoring, ES data models, risk-based alerting
Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments
Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development
Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments
Proven ability to create and maintain technical documentation runbooks, standards guides, architecture documentation
Background in detection engineering, threat hunting, or SOC operations understanding of how knowledge objects serve analysts in practice
Preferred Qualification's
Splunk Certifications: Splunk Core Certified Consultant, Splunk Enterprise Security Certified Admin (SPLK-3001), Splunk Certified Architect one or more strongly preferred
Security Certifications: GIAC (GCIA, GCIH, GCED), or equivalent
Experience with Splunk SOAR (Phantom) playbook development, orchestration, and knowledge integration
Familiarity with Splunk UBA and behavioral analytics model management
Experience in healthcare or highly regulated industries (HIPAA, Federal (NIST), NYDFS, PCI)
Experience with infrastructure-as-code tools (Ansible, Terraform) for Splunk configuration management
Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval and content management
Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention
Familiarity with Kafka, streaming data pipelines, and real-time telemetry routing