Business Title:
Splunk Architect
Location:
Oakton, Virginia
Clearance:
Active Top Secret (TS) clearance required with eligibility for Sensitive Compartmented Information (SCI).
Position Summary:
Definitive Innovative Solutions (DIS) is seeking a highly skilled Splunk Architect to lead the design, implementation, modernization, and optimization of enterprise Splunk platforms supporting mission-critical cybersecurity, operational, and analytics requirements for a federal customer.
Duties and Responsibilities
- Serve as the technical architect and subject matter expert for the customer's enterprise Splunk environment.
- Design, implement, and maintain scalable Splunk architectures supporting enterprise security monitoring, operational analytics, and mission requirements.
- Develop and maintain Splunk infrastructure, including indexers, search heads, deployment servers, forwarders, and associated platform components.
- Develop architecture standards, technical designs, configuration standards, and implementation plans for Splunk capabilities.
- Design and implement data ingestion strategies from network, security, infrastructure, application, cloud, endpoint, and other enterprise sources.
- Develop and maintain Splunk data models, indexes, sourcetypes, field extractions, parsing rules, and data normalization strategies.
- Develop and optimize Splunk Search Processing Language (SPL) searches, reports, dashboards, alerts, and correlation searches.
- Support development and tuning of security detections, use cases, and analytics in coordination with Security Operations Center (SOC) and cybersecurity teams.
- Integrate Splunk with security and enterprise technologies, including SIEM/SOAR platforms, endpoint security, vulnerability management, identity and access management, network security, cloud platforms, and ticketing systems.
- Design and implement Splunk Enterprise Security capabilities, including correlation searches, notable events, risk-based alerting, dashboards, and security monitoring workflows, as applicable.
- Analyze Splunk performance, capacity, indexing rates, search performance, storage utilization, and system health; recommend and implement optimization measures.
- Establish and maintain Splunk health, availability, performance, and capacity monitoring.
- Troubleshoot complex Splunk infrastructure, ingestion, search, integration, and performance issues.
- Develop automation and repeatable processes to improve Splunk administration, deployment, configuration management, and operational efficiency.
- Support Splunk upgrades, migrations, architecture modernization, and technology refresh activities.
- Evaluate new Splunk capabilities and recommend enhancements based on customer mission requirements.
- Establish and maintain technical documentation, including architecture diagrams, configuration standards, data source inventories, operating procedures, and troubleshooting guides.
- Ensure Splunk architecture and implementation comply with applicable federal security requirements, customer policies, configuration standards, and contract requirements.
- Support cybersecurity assessments, audits, Authority to Operate (ATO) activities, continuous monitoring, and security control implementation as required.
- Collaborate with government personnel, contractors, system owners, cybersecurity personnel, and technical stakeholders to identify requirements and resolve technical issues.
- Participate in technical reviews, design sessions, change-control activities, and engineering working groups.
- Provide technical mentoring and knowledge transfer to Splunk administrators, engineers, analysts, and other technical personnel.
- Identify opportunities to improve system reliability, scalability, security, automation, and operational efficiency.
- Perform other duties as assigned in support of contract and program objectives.
Minimum Qualifications
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical discipline and 8 years of relevant experience, or an equivalent combination of education and experience.
- 5 or more years of hands-on Splunk experience in an enterprise environment.
- Demonstrated experience designing, implementing, administering, and troubleshooting Splunk environments.
- Demonstrated experience developing Splunk searches, dashboards, alerts, reports, and data integrations using SPL.
- Demonstrated experience with enterprise log ingestion and data onboarding from multiple technology platforms.
- Demonstrated experience with Splunk architecture components, including forwarders, indexers, search heads, and deployment/configuration management.
- Demonstrated experience supporting cybersecurity, SIEM, SOC, or security monitoring operations.
- Experience with Linux and/or Windows operating systems in an enterprise environment.
- Ability to successfully complete required background investigations, suitability determinations, and customer-specific security requirements.
- Ability to work onsite at the customer location when required by the contract.
Preferred Qualifications
- Splunk Enterprise Architect, Splunk Core Certified Consultant, Splunk Enterprise Certified Admin, Splunk Enterprise Security Certified Admin, or comparable Splunk certification.
- Experience with Splunk Enterprise Security (ES).
- Experience with Splunk SOAR.
- Experience implementing Risk-Based Alerting (RBA).
- Experience developing cybersecurity detection and monitoring use cases.
- Experience integrating Splunk with cloud environments, particularly Microsoft Azure or AWS.
- Experience with Splunk on-premises, cloud, or hybrid architectures.
- Experience supporting federal civilian, Department of Defense, or Intelligence Community customers.
- Experience with federal cybersecurity frameworks and requirements, including NIST, FISMA, RMF, FedRAMP, STIGs, and applicable agency security policies.
- Experience with infrastructure-as-code, configuration management, or automation technologies such as Ansible, Terraform, or Git.
- Experience with APIs and scripting languages such as Python, PowerShell, or Bash.
Why Join DIS
Our culture is the heartbeat of our success. We believe that innovation doesn't just happen, it's cultivated through curiosity, collaboration, and a shared commitment to excellence. Our team is made up of passionate professionals who thrive in a dynamic environment where ideas are valued, creativity is encouraged, and growth is a shared journey.
Innovation at the Core
We foster a culture where innovation is not just a buzzword, it's a mindset. From daily stand-ups to strategic brainstorming sessions, we create space for experimentation and bold thinking. Our teams are empowered to challenge the status quo, explore emerging technologies, and develop solutions that push boundaries and deliver real impact for our clients.
People-First Philosophy
We invest in our people because we know they are our greatest asset. Through continuous learning opportunities, mentorship programs, and cross-functional collaboration, we help our team members grow both personally and professionally. We celebrate diverse perspectives and believe that the best ideas come from inclusive, empowered teams.
Agility and Ownership
Our culture embraces agility and accountability. We encourage initiative, reward problem-solving, and support a fail-fast, learn-faster approach. Every team member is trusted to take ownership of their work and contribute meaningfully to our mission.
Collaboration Without Borders
Whether remote or in-person, we maintain a strong sense of connection and community. We use modern tools to collaborate seamlessly across teams and time zones, ensuring that innovation and communication flow freely.
Definitive Innovative Solutions, LLC is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.
Definitive Innovative Solutions, LLC will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another.
