Security Engineer - Splunk

We are actively seeking a dedicated Security Engineer to enhance our Enterprise Security team within the overall Security organization at Recorded Future. This role focuses on optimizing and maintaining our security stack, with a strong emphasis on the Splunk environment. We value innovative thinkers who can devise creative solutions to engineering challenges, thereby empowering our security team to effectively manage enterprise-wide security.

Key Responsibilities:

• Deploy and configure the Splunk environment to assist our internal security team in managing security threats and risks efficiently.
• Collaborate cross-functionally with tech stack owners to configure and maintain security-centric tools, including ELK, IAM tools, and DLP technologies.
• Architect, build, and enhance existing solutions to address complex challenges.
• Create dashboards, design data models, and analyze security logs to ensure the security of the Recorded Future enterprise.

Qualifications:

• Minimum of 3 years of experience with the deployment, configuration, and troubleshooting of SIEM appliances, particularly Splunk.
• Experience working within a CSIRT or SOC environment is preferred.
• Familiarity with Cribl is a plus.
• Proficient in managing distributed Splunk cluster infrastructure and its components.
• Experience administering a Splunk environment, including search heads, indexers, deployers, deployment servers, universal forwarders, and Splunk IT Service Intelligence.
• Strong knowledge of Splunk SPL and visualizations for identifying anomalies and trends.
• Ability to onboard new data sources into SIEMs/Splunk effectively.
• Proficient in scripting languages such as Perl, Bash, or Python to develop custom code as needed.
• Capable of translating large datasets into actionable insights for the security team and leadership.
• Excellent problem-solving and analytical skills.
• Strong time management and organizational abilities.
• Willingness to travel up to 10% of the time.