Technology

Splunk & Cribl Platform Engineer IV

Shree Narayani Networking Solutions LLCRichmond, VA🇺🇸United StatesPosted Oct 22, 2026

Quick Overview

Seniority

Mid Senior

Work mode

Hybrid

Location

Richmond, VA, United States

Posted

18 hours ago

AWSSplunkData PipelineGoogle CloudAzureLinuxWindows Server

Job Description

Job Details:

Job Title: Splunk & Cribl Platform Engineer IV
Job Location: Richmond, VA/ Charlotte, NC / Pennington, NJ (4 days onsite / 1 day remote for the first 6 months, then 3 days onsite / 2 days remote after) Hybrid role.
Job Type: 12+ Months contract

Summary
Client is hiring a senior Splunk and Cribl platform engineer to support a large-scale, highly distributed Splunk Enterprise and Splunk Cloud environment that directly feeds the bank's Information Security and SOC teams. This is a production ownership role, not a monitoring or dashboard-building role.

What You'll Do

Splunk Platform Operations and Production Stability

Own end-to-end production support for search head clusters, indexer clusters, deployers, deployment servers, and forwarders
Ensure high availability, performance, and resiliency for security and operational use cases
Lead incident response, troubleshooting, root cause analysis, and service restoration for Splunk and Cribl
Proactively identify risks, capacity constraints, and performance bottlenecks, implement preventive and tuning measures

Security Log Ingestion and SIEM Enablement

Serve as a key technical enabler for Information Security and SOC teams
Onboard and normalize new data sources, supporting CIM compliance and field normalization
Tune ingestion pipelines using props.conf and transforms.conf
Build and support dashboards, searches, and alerts for threat detection and investigations

Cribl Data Pipeline Management

Administer and support Cribl for data routing, filtering, enrichment, and cost optimization
Ensure data integrity, reliability, and performance across ingestion pipelines
Collaborate with architecture teams on data flow strategies and onboarding standards

Governance, Documentation, Compliance

Develop and maintain runbooks, SOPs, installation guides, and operational documentation
Adhere to change management, incident management, and SLA commitments

Must-Have Qualifications

5+ years hands-on administering large-scale Splunk Enterprise or Splunk Cloud
Real platform admin experience, not dashboard or alert building for other applications, fastest screen-out
Indexer clustering and search head clustering
Universal and heavy forwarder architectures
SmartStore / S3-compatible object storage
SPL, search optimization, summary indexing, data model acceleration
Deep experience with security log ingestion and SIEM use cases
Proven ability to lead production incidents, perform RCA, drive preventive solutions
Strong Linux administration
Cribl administration (data routing, filtering, enrichment), required, not a nice-to-have
Excellent written and verbal communication, able to engage senior stakeholders

Desired Skills

Splunk certifications (Enterprise Admin or Enterprise Architect)
Splunk ES and SOAR experience (Phantom or equivalent, general exposure fine)
Cloud logging/security architecture exposure (AWS, Azure, Google Cloud Platform)
RHEL and Windows Server administration
Monitoring, APM, event management tool experience
Strong understanding of security, network, system, and database operations
Ability to balance multiple priorities in a fast-paced environment

What Success Looks Like