Position: Splunk Administrator
Company: Українська Кадрова Група
Experience required: 3y
English level: upper

Responsibilities:

● Onboard, configure, and maintain data inputs from Universal Forwarders, Splunk Apps and HTTP Event Collectors
● Develop Knowledge Objects (alerts, dashboards, reports, etc.) to comply with compliance, security and customer requirements
● Collaborate with various departments to create dashboards leveraging Simple XML or Splunk Dashboard Studio
● Architect various Splunk data ingestion mechanisms for large scale volumes, such as syslog, AWS, cloud-watch, Kinesis and Azure EventHub, and HEC
● Maintaining inputs of standard and custom sourcetypes
● Leveraging Splunk InfoSec, Splunk Security Essentials, and other tools to further enhance security posture
● Maximizing data ingestion of relevant data while staying under daily license capacity
● Creating and refining indexes as necessary to facilitate
● Adhering to the ‘need to know basis’ and ‘principle of least privilege’ for user access control
● Train and Mentor peer admins and other groups on their use of Splunk
● Troubleshooting Splunk performance issues and opening support cases with Splunk
● Closely work with Security Operations team to develop correlation searches, normalize the data for CIM (Common Information Model) compliance

Requirements:

● 2-5 years of experience administering Splunk Cloud and/or Splunk Enterprise, Universal Forwarders, Deployment Servers, and Heavy Forwarders
● Experience with Linux and Windows operating systems, as well as familiarity with AWS and Azure public cloud, and Universal Forwarders for Splunk administration
● Experience with Splunk data retention strategies, backups, and archiving
● Familiarity with Splunkbase, Splunk Support, Splunk Answers, and the Splunk ecosystem
● Ability to run a variety of projects simultaneously and willingness to learn new technologies in a team-oriented environment
● Familiarity with security frameworks like SOC 2, ISO 27001, CIS Controls, etc.
● Strong customer service skills to participate in customer inquiries as needed
● Experience working with cross functional teams
● Familiarity with working with Agile methodologies and the relevant tools such as JIRA
● Splunk Core Certified Power User, Splunk Core Certified Advanced Power User, and/or Splunk Cloud Certified Admin would be a plus
● Experience with other Splunk products or monitoring products would be a plus
● Strong analytic skills to identify patterns and the ability to creatively join relevant datasets
● Excellent organizational, analytical, verbal, and written communication skills