INTL India - Remote Splunk Engineer

Insight Global is seeking a remote Splunk Engineer to join a global consulting firm.

This person will be the person who shapes how this organization collects, normalizes, and operationalizes security telemetry across the organization.

You would work directly with the Continuous Monitoring & Detection function to ensure every detection rule has a validated, high-fidelity data source behind it. You would be working on the ingestion pipeline, the health of our log sources, and the quality of the data the organizations CSIRT depends on to detect and investigate threats.

If you are someone who likes to proactively identify data quality issues before they become detection gaps, push back when someone wants to onboard a source that cannot meet the minimum field requirements, and treat the ingestion pipeline as a security control, not an IT service, this is the position for you!

Compensation:
$10/hr to $15/hr
Exact compensation may vary based on several factors, including skills, experience, and education.
Benefit packages for this role will start on the 31st day of employment and include medical, dental, and vision insurance, as well as HSA, FSA, and DCFSA account options, and 401K retirement account access with employer matching. Employees in this role are also entitled to paid sick leave and/or other paid time off as provided by applicable law.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment regardless of their race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please send a request to HR@insightglobal.com.To learn more about how we collect, keep, and process your private information, please review Insight Global's Workforce Privacy Policy: https://insightglobal.com/workforce-privacy-policy/.

-Strong SPL knowledge and ability to write complex searches, optimize them, and explain why they perform the way they do
-Hands-on Splunk data onboarding experience - forwarders, HEC, API inputs, props/transforms, field extractions
-CIM normalization - understanding of the data models, you know how to validate compliance, and you know what breaks when a source is not normalized
-Splunk Enterprise Security - correlation searches, notable events, data model acceleration
-Index management - retention policies, tiered storage, capacity planning
-Experience with Splunk ES in a security operations context, not just as a log aggregation tool

-Risk-Based Alerting (RBA) implementation and tuning
-ESCU - deploying, customizing, and maintaining Splunk's detection content library
-Python - scripted inputs, custom Splunk commands, REST API integrations
-Familiarity with MITRE ATT&CK and how it maps to Splunk data sources and detection content
-Splunk Cloud administration
-Experience with CrowdStrike, Microsoft Defender, or Entra ID log sources specifically
-Splunk certifications - Splunk Core Certified Power User or above

Benefit packages for this role will start on the 1st day of employment and include medical, dental, and vision insurance, as well as HSA, FSA, and DCFSA account options, and 401k retirement account access with employer matching. Employees in this role are also entitled to paid sick leave and/or other paid time off as provided by applicable law.