Splunk Performance & Content Engineer
Unisys Corporation3 days ago
Bengaluru, IndiaSenior
Responsibilities
- Optimize SPL, scheduled searches, dashboards, data models, summary indexing, report acceleration, and search scheduling for performance, scalability, and reliability.
- Remediate parsing, sourcetype, index, ingestion, volume, and other data-quality issues using props, transforms, event filtering, and index design.
- Monitor Splunk platform health and search performance, including concurrency, skipped searches, indexing latency, queue blocking, and resource usage.
- Tune ITSI services, KPIs, and episodes during ACSC business hours.
- Develop and maintain dashboards, reports, alerts, correlation searches, detection rules, data models, field extractions, lookups, event types, and tags.
- Package Splunk content into apps and manage its version-controlled lifecycle, testing, and release processes.
- Map detections to MITRE ATT&CK, reduce false positives, establish content standards, review peer content, and educate users on efficient SPL.
- Collaborate with SOC, SRE, application, and dashboard-owner teams to gather requirements and produce actionable content.
- Maintain runbooks and knowledge articles, manage the prioritized backlog, and report weekly burn-down and monthly service findings.
- Report on content quality, search performance, license and storage trends, and capacity-improvement recommendations.
Requirements
- BA/BS degree and 8+ years of relevant experience, or an equivalent combination of education and experience.
- More than 7 years of experience with Advanced SPL, including data models, accelerated searches, and summary indexing.
- Experience analyzing search and scheduler performance, including skew, concurrency, search quotas, and resource usage.
- Experience with data onboarding and normalization, including props, transforms, and CIM mapping.
- Experience tuning Splunk ITSI services, KPIs, and episodes.
- Ability to work with application and dashboard owners without owning dashboard design.
- Clear written and spoken English and availability to overlap the ACSC working day in Pacific Time.
- Preferred Splunk Certified Power User, Admin, or Architect certification.
- Preferred experience with Splunk Observability Cloud, OpenTelemetry, Splunk Enterprise Security, ITSI, Dashboard Studio, REST APIs, and the Splunk SDK.
- Preferred Python or Bash scripting experience, detection engineering knowledge, MITRE ATT&CK knowledge, and experience working with a Kanban or sprint-based backlog.
Benefits
- The role includes a 05:00-06:00 PT warm handover, a daily 09:15 PT stand-up, and biweekly planning and retrospective sessions.
- The position overlaps with the ACSC working day in Pacific Time and represents Shift B at ACSC ceremonies.
About Unisys Corporation
Unisys Corporation provides IT services, consulting, and software for enterprises and public-sector agencies, including digital workplace, cloud and infrastructure, cybersecurity, and enterprise computing/mainframe systems. The company was formed in 1986 and is headquartered in Blue Bell, Pennsylvania; it is publicly traded on the NYSE. Unisys works across regulated industries such as government, financial services, and transportation, offering managed services and mission-critical solutions.