THE ROLE

As a Splunk Engineer and a key member of the Security Engineering team, you will support Splunk Enterprise Security administration and management, managing enterprise SIEM infrastructure to improve data ingestions processes, including architectural work. You will provide engineering and design support for a distributed Splunk environment consisting of heavy forwarders, indexers, and search head servers, spanning security, performance, and operational roles.

THE PERSON

As an SIEM / Splunk Engineer, you will help mature the security posture of the corporate environment. You will influence others with your security mindset and inspire change at all levels. You will have excellent communication skills, both oral and written. You will be a team player, organized, responsible and a highly detailed problem solver.

KEY RESPONSIBILITIES

• Install, configure, and update Splunk Enterprise and Splunk Enterprise Security environments in a multi-site environment, following best practices from Splunk Professional Services.
• Configure multi-site Search Head clustering and advanced Splunk options like Indexer.
• Ability to handle technical add-ons for efficiently on-barding data and meeting Splunk CIM compliance for Enterprise Security accelerated data models.
• Troubleshoot and resolve issues discovered during log onboarding
• Demonstrated experience working with Security and operations team to clarify needs and requirements and to build a solution vision, including experience articulating the value of analysing machine data for operational intelligence, security, and compliance.
• Interface with AMD IT team to provide SIEM-driven insight into operations, risk, performance and behaviour
• Implement, architect, administer Splunk and Splunk Enterprise Security Suite and perform data ingestion and data visualization for Splunk and Splunk Enterprise Security Suite
• Extend SIEM to integrate threat intelligence sources in context of AMD’s risk profile
• Ability to collaborate on the design and implementation of security configurations and services to support SIEM data capture and significant analysis
• Correlate AMD’s service and app activities with threat intelligence, to pinpoint risk areas, IoCs, trajectories.
• Collaborate with AMD Product Development groups to augment and scale product logging capabilities for increased alignment and analytics with SIEM
• Administer and tune Splunk architecture, handle escalation and issue resolution for the SIEM platform components
• Develop real-time analysis of security and application data, delivering timely vision to support risk-driven detection and response.
• Achieve capacity planning for Splunk infrastructure

PREFERRED EXPERIENCE:

• Strong knowledge of security concepts, networks, risk procedures, security patterns, authentication technologies and security attacks.
• Capacity to develop, evaluate, and document specific metrics for management purposes.
• Ability to perform maintenance and optimisation of existing clustered Splunk deployments.
• Experience in creating dashboards to monitor the traffic volumes, response times, errors, and warnings across various data centres.
• Proficiency in developing documentation with processes and procedures.
• In-depth experience in using customer focused Splunk Enterprise Security SIEM engineering background.
• Ability to create, manage, and support automation solutions for Splunk deployment and orchestration in on-site and cloud environments.
• Experience with Splunk Enterprise Security or integration with other Security Information and Event Management (SIEM) platforms.
• Proficiency in data on-boarding activities including routing, parsing, and normalizing events to the Splunk Common Information Model (CIM).
• Proficiency in onboarding data using Splunk developed add-ons for Windows, Linux, and common third-party devices and applications.

Required Qualifications

• Bachelor’s Degree.
• Splunk Certification (Certified Admin or Certified Architect) preferable