Assistant Splunk Admin Jobs (NOW HIRING)

Job Summary:
True Zero Technologies is a veteran-owned small business focused on enabling people and technology to enhance organizational outcomes. They are seeking a Splunk Engineer to maintain various clients' Splunk instances, emphasizing data onboarding, content development, reporting, and visualizations.
Responsibilities:
• Maintain various client's Splunk instances with a heavy emphasis on data on-boarding, content development, reporting, and visualizations.
• Possess prior Splunk engineering and administration experience, meet the necessary certification prerequisites, and work well in a team environment.
• Support federal customers as needed.
• Receive access to the full knowledge base driven by the True Zero community and the technical backing of the entire PS team.
• Encourage collaboration and growth through information sharing and knowledge workshops.
• Access internal Slack channel to stay connected with the team and the necessary tools to train, demo, test and grow professional skills.
• US Background Check Required.
• Splunk Consultant Certification.
• Heavy Splunk ES Experience.
• Experience ingesting logs into Splunk via Cribl is required.
• Experience with RBA.
• Develop and Implement Actionable Alerts and Workflow for Splunk as a SIEM (Security Information & Event Management) tool.
• Develop and Implement Apps & Knowledge Objects (KO) like Dashboard, Reports, Data Models.
• Work with the Splunk Architect/Admin to promote private KO to Global KO.
• Assist, and/or train CISO Splunk Engineering team on Data Lifecycle.
• Support Assist, train, and/or host workshops CISO teams and analysts on Searching and Content Development.
• Develop and implement automation to improve efficiency of CISO workflows using Splunk.
• Assist in development of advanced security use cases in Splunk.
• Develop risk rules and risk incident rules to correlate and alert to significant cyber events.
• Develop custom dashboards specific to RBA (Risk Based Alerting) to highlight risk detail, health analysis and risk suppression.
• Configure incident response and remediation workflows for ES around notable events (RBA or otherwise alerted).
• Develop custom machine learning (ML) models to support anomaly-detection based augmentation of alerting.
• Work with numerous stakeholders to implement & maintain event logging from various operating systems, applications, identity providers, network infrastructure, and cloud service providers.
• Understanding of network protocols, operating systems, applications, and device event telemetry.
Qualifications:
Required:
• US Background Check Required
• Splunk Consultant Certification
• Heavy Splunk ES Experience
• Experience ingesting logs into Splunk via Cribl is required
• Experience with RBA
• Develop and Implement Actionable Alerts and Workflow for Splunk as a SIEM (Security Information & Event Management) tool
• Develop and Implement Apps & Knowledge Objects (KO) like Dashboard, Reports, Data Models
• Work with the Splunk Architect/Admin to promote private KO to Global KO
• Assist, and/or train CISO Splunk Engineering team on Data Lifecycle
• Support Assist, train, and/or host workshops CISO teams and analysts on Searching and Content Development
• Develop and implement automation to improve efficiency of CISO workflows using Splunk Assist in development of advanced security use cases in Splunk
• Develop risk rules and risk incident rules to correlate and alert to significant cyber events
• Develop custom dashboards specific to RBA (Risk Based Alerting) to highlight risk detail, health analysis and risk suppression
• Configure incident response and remediation workflows for ES around notable events (RBA or otherwise alerted)
• Develop custom machine learning (ML) models to support anomaly-detection based augmentation of alerting
• Work with numerous stakeholders to implement & maintain event logging from various operating systems, applications, identity providers, network infrastructure, and cloud service providers.
• Understanding of network protocols, operating systems, applications, and device event telemetry
Preferred:
• Candidates with backgrounds supporting federal customers is a plus
Company:
True Zero Technologies, a veteran-owned small business. Founded in 2016, the company is headquartered in Annandale, USA, with a team of 51-200 employees. The company is currently Growth Stage.