True Zero Technologies ยท 11 hours ago
Splunk Engineer - Consultant Certified/Heavy ES Experience Required (R-00028)
100% Remote
Full-time
Remote
Mid Level
Maximize your interview chancesInformation ServicesInformation Technology
Insider Connection @True Zero Technologies
Get 3x more responses when you reach out via email instead of LinkedIn.
Responsibilities
Maintain various client's Splunk instances with a heavy emphasis on data on-boarding, content development, reporting, and visualizations.
Develop and Implement Actionable Alerts and Workflow for Splunk as a SIEM (Security Information & Event Management) tool
Develop and Implement Apps & Knowledge Objects (KO) like Dashboard, Reports, Data Models
Work with the Splunk Architect/Admin to promote private KO to Global KO
Assist, and/or train CISO Splunk Engineering team on Data Lifecycle
Support Assist, train, and/or host workshops CISO teams and analysts on Searching and Content Development
Develop and implement automation to improve efficiency of CISO workflows using Splunk
Assist in development of advanced security use cases in Splunk
Develop risk rules and risk incident rules to correlate and alert to significant cyber events
Develop custom dashboards specific to RBA (Risk Based Alerting) to highlight risk detail, health analysis and risk suppression
Configure incident response and remediation workflows for ES around notable events (RBA or otherwise alerted)
Develop custom machine learning (ML) models to support anomaly-detection based augmentation of alerting
Work with numerous stakeholders to implement & maintain event logging from various operating systems, applications, identity providers, network infrastructure, and cloud service providers.
Qualification
Find out how your skills align with this job's requirements. If anything seems off, you can easily click on the tags to select or unselect skills to reflect your actual expertise.
Required
US Background Check Required
Splunk Consultant Certification
Heavy Splunk ES Experience
Experience with RBA
Develop and Implement Actionable Alerts and Workflow for Splunk as a SIEM (Security Information & Event Management) tool
Develop and Implement Apps & Knowledge Objects (KO) like Dashboard, Reports, Data Models
Work with the Splunk Architect/Admin to promote private KO to Global KO
Assist, and/or train CISO Splunk Engineering team on Data Lifecycle
Support Assist, train, and/or host workshops CISO teams and analysts on Searching and Content Development
Develop and implement automation to improve efficiency of CISO workflows using Splunk
Assist in development of advanced security use cases in Splunk
Develop risk rules and risk incident rules to correlate and alert to significant cyber events
Develop custom dashboards specific to RBA (Risk Based Alerting) to highlight risk detail, health analysis and risk suppression
Configure incident response and remediation workflows for ES around notable events (RBA or otherwise alerted)
Develop custom machine learning (ML) models to support anomaly-detection based augmentation of alerting
Work with numerous stakeholders to implement & maintain event logging from various operating systems, applications, identity providers, network infrastructure, and cloud service providers.
Understanding of network protocols, operating systems, applications, and device event telemetry
Preferred
Candidates with backgrounds supporting federal customers is a plus.
Benefits
Best in class medical coverage
100% of medical premiums covered by True Zero
Company wide new business incentive programs
Contribution Incentives (i.e. white papers, blog posts, internal webinars, etc.)
3 weeks of PTO starting + 11 Paid Holidays Annually
401k Program with 100% company match on the first 4%
Monthly reimbursement of Cell Phone and Home Internet costs
Paternity/Maternity Leave
Investment in training and certifications to broaden and deepen your technical skills
Company
True Zero Technologies
True Zero Technologies, a veteran-owned small business.
Founded in 2016
51-200 employees
Funding
Current Stage
Growth StageLeadership Team
Carl Salzano
CEO
Jonathan Cooper
CTO
Recent News
Company data provided by crunchbase
