Splunk Engineer

h3SIEM Data Onboarding Engineer (Splunk) /h3 h3Project Context /h3 pFor our client, we are looking for an experienced SIEM Data Onboarding Engineer to join a large-scale cybersecurity and security operations environment. The consultant will play a key role in integrating new data sources into a Splunk-based SIEM platform, ensuring high-quality log ingestion, normalization, and alignment with security monitoring and detection requirements. /p pThe environment includes a broad range of infrastructure, cloud, network, security, and application technologies. Experience with Cribl is highly desirable, as it is used for telemetry optimisation, routing, transformation, and data management before ingestion into Splunk. /p h3Responsibilities /h3 ulliLead the onboarding of new log and telemetry sources into Splunk. /liliGather technical requirements from stakeholders and source system owners. /liliDesign and implement scalable ingestion pipelines. /liliConfigure and validate data collection mechanisms. /liliTroubleshoot ingestion, parsing, and normalization issues. /liliMap log sources to the Splunk Common Information Model (CIM). /liliCollaborate with security operations and detection engineering teams. /liliPerform data quality assessments and resolve data integrity issues. /liliOptimise data flows for scalability, performance, and cost efficiency. /liliSupport onboarding of cloud, infrastructure, application, network, and security data sources. /liliCreate and maintain onboarding documentation and operational procedures. /liliContribute to SIEM onboarding standards and continuous improvement initiatives. /li /ul h3Required Skills /h3 h3Splunk /h3 ulliStrong hands-on experience with Splunk Enterprise and/or Splunk Cloud. /liliProven background onboarding complex log sources. /liliExperience with:ulliUniversal Forwarders /liliHeavy Forwarders /liliData Inputs /liliIndex Management /liliSource Types /liliField Extractions /liliSplunk CIM /liliSPL (Search Processing Language) /li /ul /liliStrong troubleshooting and problem-solving skills. /li /ul h3SIEM Security /h3 ulliGood understanding of SIEM architecture and security monitoring. /liliExperience with logs from:ulliWindows and Linux environments /liliNetwork devices /liliSecurity appliances /liliAzure, AWS and/or GCP /liliEnterprise applications and middleware /li /ul /liliKnowledge of event correlation and log management principles. /li /ul h3Data Engineering Integration /h3 ulliExperience with ingestion architectures and log transport technologies. /liliUnderstanding of JSON, XML, Syslog, REST APIs, and event streaming. /liliScripting and automation experience with Python, PowerShell, or similar. /li /ul h3Preferred Skills /h3 h3Cribl /h3 ulliHands-on experience with Cribl Stream. /liliExperience creating pipelines, transformations, routing rules, and filters. /liliKnowledge of telemetry optimisation and observability practices. /liliExperience reducing SIEM ingestion costs through data engineering strategies. /li /ul h3Profile /h3 ulliStrong stakeholder management skills. /liliAnalytical and detail-oriented mindset. /liliAble to work independently. /liliExcellent communication skills. /liliComfortable working with security, infrastructure, and application teams. /liliFluent English required. /liliFrench prefered desirable. /li /ul