Data and Splunk Engineer

Job Description

Data Engineer / Data Scientist/ Splunk Engineer , Officer

Role Level

Officer

Role Type

Individual Contributor

Focus Area

Data Engineering & Data Science

Skill Mix

70% Data Engineering / Data Science; 30% Splunk Engineering

Experience Target

Approximately 10 years

Who we are looking for

The Data Engineer / Data Scientist/ Splunk Engineer , Officer, will support enterprise cybersecurity observability and analytics by combining deep Splunk engineering expertise with scalable data engineering and applied data science capabilities. The role is weighted (70%) towards Databricks-based data engineering, advanced analytics, and practical machine-learning solutions that convert complex security telemetry into reliable, actionable intelligence. The remaining focus(30%) towards Splunk engineering, with responsibility for developing searches, dashboards, alerts, data models, telemetry onboarding, and platform monitoring.

What you will be responsible for

As a Data Engineer / Data Scientist / Splunk Engineer , you will

• Design, develop, optimize, and maintain Splunk SPL searches, dashboards, reports, alerts, data models, field extractions, lookups, macros, and reusable knowledge objects.
• Build and enhance security observability solutions across endpoint, web proxy, firewall, network, identity, cloud, vulnerability, threat intelligence, and other enterprise telemetry.
• Onboard and validate new data sources, covering source analysis, parsing, normalization, timestamp validation, field mapping, data quality, and search readiness.
• Troubleshoot ingestion failures, telemetry gaps, latency, duplication, parsing issues, search failures, and dashboard performance concerns.
• Improve Splunk performance using efficient SPL, data model acceleration, summary indexing, lookup optimization, and appropriate search scheduling.
• Develop proactive monitoring and alerting for Splunk platform health, ingestion volumes, search execution, dashboard availability, and operational service levels.
• Partner with SOC, threat intelligence, detection engineering, security platform, and data teams to improve detection readiness and operational analytics.
• Design and maintain scalable data ingestion and transformation pipelines using Python, SQL, PySpark, Databricks, Delta Lake, and cloud services.
• Build curated, analytics-ready datasets with strong controls for data quality, reconciliation, lineage, observability, testing, and performance.
• Integrate Splunk and Databricks workflows to support telemetry enrichment, historical analytics, aggregation, and downstream reporting.
• Perform exploratory analysis and feature engineering to identify trends, anomalies, relationships, and risk indicators across cybersecurity datasets.
• Develop or support practical statistical and machine-learning use cases including anomaly detection, classification, clustering, prioritization, and entity correlation.
• Operationalize analytics through Git, CI/CD, automated testing, workflow orchestration, monitoring, documentation, and production support.
• Create clear technical documentation, dashboard guides, data dictionaries, operational runbooks, and knowledge-sharing materials.
• Mentor junior engineers, contribute to peer reviews, and promote reusable engineering and analytics practices.

What we value

These skills will help you succeed in this role

• Strong hands-on expertise in Splunk, including advanced SPL, dashboards, alerts, reports, data models, field extractions, lookups, macros, and performance optimization.
• Experience with enterprise-scale log ingestion, security telemetry onboarding, data validation, troubleshooting, and operational monitoring.
• Strong programming and data engineering skills using Python, SQL, PySpark, Databricks, ETL/ELT, Delta Lake, and distributed processing.
• Understanding of Lakehouse architecture, data modeling, orchestration, data quality, reconciliation, lineage, observability, and pipeline optimization.
• Practical knowledge of statistical analysis and machine-learning concepts such as feature engineering, anomaly detection, classification, clustering, and model evaluation.
• Understanding of cybersecurity data and workflows, including SIEM/SOAR, threat detection, endpoint telemetry, vulnerability data, identity events, incidents, and threat intelligence.
• Ability to independently own technical deliverables, resolve complex issues, collaborate across teams, and communicate effectively with technical and senior stakeholders.
• Strong focus on automation, documentation, operational excellence, governance, scalability, resiliency, and measurable outcomes.

Education & Qualifications

Minimum Qualifications

• Approximately 10 years of professional experience across Splunk engineering, security analytics, data engineering, data science, cybersecurity, cloud, or related technology disciplines.
• Bachelor's degree in computer science, information technology, data science, statistics, mathematics, engineering, cybersecurity, or a related discipline, or equivalent professional experience.
• Demonstrated hands-on experience with Splunk engineering and advanced SPL in an enterprise environment.
• Hands-on experience with Python, SQL, PySpark, Databricks or comparable data platforms, ETL/ELT, and large-scale data processing.
• Experience working with cloud platforms, preferably AWS or Azure, and with Git-based version control and CI/CD practices.
• Strong analytical, troubleshooting, documentation, and stakeholder communication skills.

Preferred Qualifications

• Experience within a SOC, threat detection, threat intelligence, security operations, or cybersecurity analytics environment.
• Experience with Cribl or similar telemetry routing, shaping, enrichment, and pipeline technologies.
• Knowledge of security data normalization, MITRE ATT&CK concepts, incident enrichment, detection engineering, and SIEM/SOAR workflows.
• Exposure to MLfl