Splunk Implementation Engineer

Position Overview: Our client is seeking a highly motivated and experienced Splunk Certified Implementation Engineer to join their team. A Splunk implementation engineer sets up, configures, and integrates Splunk software so organizations can collect, monitor, and analyze their machine and security data effectively. Key responsibilities: Splunk Architecture & Implementation - End-to-end Splunk deployments from environment scoping and architecture blueprinting through production cutover - Implement, install, and configure Splunk components. - Implement federated search and analytics pipelines, enabling data-in-place querying. - Build and tune data onboarding pipelines: configure inputs.conf, props.conf, and transforms.conf to normalize multi-vendor log sources at ingestion time into Splunk CIM-compliant data models. - Develop and optimize SPL queries, macros, and scheduled searches to power operational detection use cases. Cisco Data Fabric & Security Stack Integration - Implement Splunk data ingestion pipelines from the Cisco security product suite: Cisco Secure Firewall (ASA/FTD), Cisco Secure IDS/IPS, Cisco Identity Services Engine (ISE), Cisco Umbrella, and Cisco Thousand Eyes network intelligence telemetry. - Configure and validate Cisco Secure Endpoint and Cisco Threat Grid integration with Splunk ES for advanced malware telemetry correlation. - Cisco Meraki, Cisco Secure Network Analytics, Cisco XDR. Operations & Day-to-Day Platform Management - Perform platform health and operational stability. - Perform capacity planning, index lifecycle management, and Machine Data Lake tiering strategy to control costs without compromising retention SLAs. - Execute Splunk version upgrades, patch deployments, and configuration management across all tiers using structured change management processes. Broader Security Platform Responsibilities - Manage and optimize next-generation security controls: Cisco Secure Firewall, Palo Alto Networks NGFWs, Fortinet FortiGate, VPN concentrators, Email/Web Security Gateways, and EDR/XDR platforms. - Support Privileged Access Management (PAM) solutions and Database Activity Monitoring (DAM) platforms such as IBM Guardium as part of a holistic defense-in-depth security architecture. - Lead client-facing implementation workshops, present technical architectures and security findings to both engineering and executive stakeholders, and deliver structured knowledge transfer sessions to upskill client security teams. - Maintain accurate project documentation: HLD/LLD design artifacts, runbooks, architecture diagrams, and post-implementation reports. Technical requirements: Splunk Platform Expertise - 5+ years of hands-on Splunk implementation experience in enterprise environments, including distributed multi-site deployments. - Proven ability to architect and deploy distributed Splunk infrastructures: Indexer Clusters, Search Head Clusters, Heavy Forwarder pools, Deployment Server hierarchies, and Machine Data Lake tiers. - Deep familiarity with Splunk Enterprise Security (ES): correlation searches, threat intelligence management, adaptive response, Risk-Based Alerting (RBA), and risk scoring frameworks. - Working knowledge of Cisco Data Fabric architecture: federated search capabilities, data-in-place analytics, and the evolution from full-ingestion to hybrid/federated SIEM pipeline patterns. - Familiarity with Splunk AI Toolkit, AI-assisted investigation workflows, and SOAR playbook development using Splunk SOAR is strongly advantageous. Cisco & Network Security - Hands-on experience integrating Cisco security products with Splunk: Secure Firewall (ASA/FTD), Secure IDS/IPS, ISE, Secure Endpoint, Umbrella, ThousandEyes, and Secure Network Analytics. - Strong understanding of Cisco security event logging formats (syslog, eStreamer, REST/API telemetry) and their normalization into Splunk CIM data models. - Working knowledge of network security fundamentals: firewall policy management, IDS/IPS tuning, and VPN configuration. - Experience with additional NGFW platforms including Palo Alto Networks and Fortinet is advantageous. Qualifications: - Bachelor's degree in computer science, Information Technology, or a related field, or equivalent demonstrable experience. - Minimum 5 years of technical experience in cybersecurity implementation and professional services delivery. - Strong client-facing skills: ability to present complex security architectures to both engineering and executive audiences. - Excellent written and verbal communication skills in English; Arabic proficiency is advantageous for client engagements in Oman. Certifications: Splunk Cybersecurity Defense Track | Security Operations Focus - Splunk Certified Cybersecurity Defense Analyst - Splunk Certified Cybersecurity Defense Engineer - Splunk Certified Cybersecurity Defense Architect Splunk Platform Administration Track | Infrastructure / Deployment Focus - Splunk Enterprise Certified Admin - Splunk Enterprise Security Certified Admin - Splunk Enterprise Certified Architect - Splunk SOAR Certified Automation Developer Cisco Security Certifications - Cisco Certified (CCIE Security) - Cisco Certified (CCNP Security) Broader Security Certifications - Certified Information Systems Security Professional (CISSP) - Certified Ethical Hacker (CEH) - GIAC Security Operations Certified (GSOC) Originally posted on Himalayas