Lead Splunk Architect

Job not on LinkedIn

🔥 0 minutes ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CyKor

WebsiteLinkedInAll Job Openings

11 - 50 employees

CyKor, is a Service-Disabled Veteran-Owned Small Business. CyKor was created to help bridge the gap between vendor and customer by delivering integrated solutions for sustainable results. Our highly skilled technology experts provide organizations trusted advisor-ship, giving them the confidence needed to accomplish their mission.

📋 Description

• Define and architect enterprise Splunk architecture supporting high availability, scalability, resilience, disaster recovery, and long-term growth • Design and oversee distributed Splunk environments including: Indexer Clusters, Search Head Clusters, Deployment Servers, Cluster Managers, Heavy Forwarders, Universal Forwarders, License Management, Splunk Cloud and Hybrid architectures • Develop technical roadmaps, modernization strategies, migration plans, and platform lifecycle recommendations • Evaluate current platform capabilities and recommend architectural improvements supporting SOC operations and enterprise cybersecurity initiatives • Serve as the technical lead for all Splunk engineering activities • Provide mentorship and technical direction to Splunk Engineers, Security Engineers, Detection Engineers, and SOC Analysts • Review architecture, engineering designs, implementation plans, dashboards, searches, integrations, and custom applications • Establish engineering standards and best practices across index naming, Sourcetypes, CIM compliance, field extractions, knowledge objects, configuration management, change control, application lifecycle management, role-based access control • Architect scalable and resilient Splunk infrastructure supporting enterprise data volumes • Lead platform optimization including Search performance, Index performance, Storage management, Retention policies, License utilization, Data lifecycle management, Search concurrency, Data Model Acceleration • Guide upgrades, patching, backup, disaster recovery, and high availability planning • Lead troubleshooting of complex ingestion, parsing, indexing, search, and performance issues • Define enterprise data onboarding strategies across security, infrastructure, cloud, identity, endpoint, network, and application data sources • Oversee parsing, routing, index design, field extraction, source normalization, CIM implementation, retention policies, data quality • Lead integrations with firewalls, IDS/ IPS, EDR, NDR, Identity providers, Cloud platforms, Vulnerability management, Ticketing systems, SIEM and SOAR technologies, Threat Intelligence platforms • Architect Splunk capabilities supporting Threat Detection, Threat Hunting, Incident Response, Security Monitoring, Risk-Based Alerting, Compliance Reporting • Guide development of Correlation Searches, Dashboards, Reports, Data Models, Detection Content, Enterprise Security Content • Improve detection fidelity while reducing false positives • Ensure Splunk capabilities support rapid investigation, evidence collection, event reconstruction, and executive reporting • Architect automation strategies using Splunk SOAR • Design and oversee playbooks for Incident enrichment, IOC validation, Threat intelligence lookups, Malware analysis, Case management, Automated containment, Notification workflows • Integrate SOAR with enterprise security technologies using Python, REST APIs, and supported applications • Establish automation governance and reusable orchestration standards • Establish engineering governance for Configuration Management, App Lifecycle, Knowledge Object Management, Detection Content, Source Onboarding, Dashboard Standards • Review deployment packages and engineering deliverables prior to production release • Ensure engineering activities comply with change management, testing, documentation, rollback, and operational readiness requirements • Serve as the primary technical advisor for Splunk architecture and platform strategy • Communicate technical risks, roadmap priorities, and architectural recommendations to executive leadership and program stakeholders • Translate business and mission requirements into scalable technical solutions • Coordinate activities with infrastructure, cloud, networking, identity, cybersecurity, and vendor teams • Develop and maintain Architecture diagrams, Engineering standards, Technical designs, Runbooks, Standard Operating Procedures, Disaster Recovery documentation, Knowledge Base articles, Technical decision records • Evaluate emerging Splunk capabilities and recommend improvements to maximize platform value • Foster engineering excellence through mentorship, standards, and continuous process improvement

🎯 Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or related field; equivalent professional experience may be substituted. • 8+ years of enterprise Splunk administration and engineering experience • 5+ years designing enterprise-scale distributed Splunk environments • Experience leading Splunk Enterprise Security implementations • Experience with Splunk Cloud and hybrid architectures • Experience supporting Security Operations Centers (SOC) • Experience leading technical teams and architecture initiatives • Experience with enterprise cybersecurity monitoring and incident response • Active security clearance strongly preferred (Public Trust or higher) • CERTIFICATIONS: Required: Splunk Enterprise Certified Architect • Preferred: Splunk Enterprise Security Certified Admin; Splunk Core Certified Consultant; Splunk SOAR Certified Automation Developer; CISSP; GIAC (GCIA, GCIH, or GCED); AWS, Azure, or Google Cloud certifications

🏖️ Benefits

• Remote schedule with availability for some related travel (0%-25%)