Apply on Employer Site

Booz Allen Hamilton · 21 hours ago

SIEM Data Onboarding Engineer

Norfolk, VA

Full-time

Hybrid

Mid Level

$99K/yr - $225K/yr

3+ years exp

Booz Allen Hamilton is a consulting firm that provides a range of services including technology and engineering solutions. They are seeking a SIEM Data Onboarding Engineer to design, deploy, and manage Splunk infrastructure while collaborating with teams to ensure effective data ingestion and performance management.

ConsultingCyber SecurityIT InfrastructureManagement ConsultingSecurity

Growth Opportunities

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Design, deploy, and manage Splunk infrastructure

Develop and maintain Splunk dashboards, queries, and alerts

Integrate Splunk with various data sources to ensure comprehensive data ingestion

Monitor and troubleshoot Splunk performance issues

Collaborate with cross-functional teams to gather requirements and provide Splunk solutions

Implement and enforce best practices for Splunk data management and retention

Provide user training and support for Splunk-related activities

Qualification

Splunk managementCribl configurationLinux administrationWindows administrationDoD 8570 IAT Level IIScripting languagesNetworking fundamentalsBasic troubleshootingCommon log formatsGit knowledgeAnsible playbooksCommunication skills

Required

2+ years of experience in managing and configuring Splunk, and in Splunk architecture, including indexers, search heads, forwarders, and deployment servers

2+ years of experience configuring Cribl sources, destinations, routes and collectors, and building pipelines to parse, normalize, enrich, mask, dedupe, and route data to Targets

2+ years of experience authoring and maintaining props.conf, transforms.conf, inputs.conf, and outputs.conf, and packaging Apps or TAs

2+ years of experience in Linux and Windows administration, including file paths, services, permissions, and log locations

1+ years of experience with Cribl Redmap or JavaScript functions

1+ years of experience with regex for field extraction and event breaking, and Splunk REST API for automation and operational tasks

Active TS/SCI clearance; willingness to take a polygraph exam

Associate's degree and 5+ years of experience supporting IT projects and activities, OR Bachelor's degree and 3+ years of experience supporting IT projects and activities, OR Master's degree and 1+ years of experience supporting IT projects and activities, OR 10+ years of experience supporting IT projects and activities in lieu of a degree

DoD 8570 IAT Level II certification, including Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND certification

Ability to obtain a DoD 8570 Cyber Security Service Provider - Infrastructure Support certification, including CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND certification, within 60 days of start date