Apply on Employer Site

ENS Solutions, LLC · 18 hours ago

SIEM Data Onboarding Engineer - Active TS/SCI with CI Poly

Reston, VA

Full-time

Onsite

Mid Level

3+ years exp

ENS Solutions, LLC is a service-disabled veteran owned IT consulting and management firm that provides solutions for the Department of Defense and Intelligence Community. They are seeking a Splunk Engineer responsible for managing and enhancing the Splunk environment, ensuring seamless data ingestion, analysis, and visualization, while collaborating with cross-functional teams to support business needs and security operations.

Information Technology & Services

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Design, deploy, and manage Splunk infrastructure

Develop and maintain Splunk dashboards, queries, and alerts

Integrate Splunk with various data sources to ensure comprehensive data ingestion

Monitor and troubleshoot Splunk performance issues

Collaborate with cross-functional teams to gather requirements and provide Splunk solutions

Implement and enforce best practices for Splunk data management and retention

Provide user training and support for Splunk-related activities

Qualification

Splunk managementSplunk architectureLinux administrationWindows administrationCribl configurationData pipeline buildingSPL proficiencyNetworking fundamentalsTroubleshooting toolsPython scriptingBash scriptingPowerShell scriptingGit knowledgeAnsible knowledgeLoad-Balancer fundamentalsRegex skillsCommunication skills

Required

2+ years of experience in managing and configuring Splunk, 2+ years of experience in Splunk architecture: indexers, search heads, forwarders, deployment server and 1+ year with Splunk REST API for automation and operational tasks

2+ years configuring Cribl sources, destinations, routes and collectors

2+ years building pipelines to parse, normalize, enrich, mask/dedup, and route data to Splunk and other targets

2+ years authoring/maintaining props.conf, transforms.conf, inputs.conf, outputs.conf and packaging Apps/TAs

2+ years in Linux and Windows administration: file paths, services, permissions, and log locations

1+ year with basic familiarity with Cribl Redmap/JavaScript functions

1+ year with regex skills for field extraction and event breaking

Active TS/SCI clearance; willingness to take a polygraph exam

Associate's degree and 5+ years of experience supporting IT projects and activities, OR Bachelor's degree and 3+ years of experience supporting IT projects and activities, OR Master's degree and 1+ years of experience supporting IT projects and activities, OR 10+ years of experience supporting IT projects and activities in lieu of a degree

DoD 8570 IAT Level II certification, including Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND certification

Must obtain a DoD 8570 Cyber Security Service Provider - Infrastructure Support certification, including CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND certification prior to start date