Senior Splunk Engineer at Dragonfli Group

United States

<h3>Description</h3> <p>Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.</p><p>We are seeking a Senior Splunk Engineer to serve as a Subject Matter Expert (SME) for a mission-critical cybersecurity initiative. In this role, you will be responsible for the end-to-end architecture, design, deployment, and maintenance of enterprise-level Splunk environments across hybrid on-premise (Unix/Linux) and cloud-based infrastructures. You will collaborate extensively with DevOps, Security, and IT teams to ensure system availability, data integrity, and operational excellence. This role requires a minimum of 5 years of hands-on experience with Splunk Enterprise, specifically focusing on complex data ingestion, system configuration, and automation.</p><p>This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency required. If hired, all work related to this role must be performed within the continental U.S.</p><p><br/></p><p><strong>Key Responsibilities</strong></p><ul><li><strong>System Architecture &amp; Design:</strong> Design, deploy, and maintain large-scale on-premises and cloud-based Splunk environments to support enterprise monitoring and security alerting.</li><li><strong>Configuration Management:</strong> Manage knowledge objects (fields, extractions, tags, event types, lookups, macros) and oversee configuration files (.conf and .cfg) across recent Splunk Enterprise versions.</li><li><strong>Data Ingestion &amp; Troubleshooting:</strong> Analyze and resolve complex data ingestion and parsing issues to ensure accurate data flow and integrity.</li><li><strong>Content Development:</strong> Create and optimize complex Splunk queries (SPL), dashboards, and alerts to support security and operational objectives.</li><li><strong>Automation:</strong> Develop automation workflows and dashboard interfaces to streamline operations and reduce manual overhead.</li><li><strong>Integration:</strong> Utilize REST APIs to integrate Splunk with external systems and cloud platforms.</li><li><strong>Collaboration &amp; Mentorship:</strong> Collaborate with cross-functional teams (DevOps, Security) and provide mentorship and technical guidance to junior team members.</li><li><strong>Maintenance:</strong> Perform upgrades, patching, and performance tuning; participate in off-hours and weekend maintenance efforts as required.</li></ul><p><br/></p> <h3>Requirements</h3> <p><strong>Must-Have Qualifications</strong></p><ul><li><strong>Experience:</strong> 5+ years of hands-on experience with Splunk Enterprise in a large-scale environment.</li><li><strong>Technical Proficiency:</strong> Proficiency in Splunk system architecture, deployment, and configuration management.</li><li><strong>Search Processing Language (SPL):</strong> Advanced ability to write complex queries for dashboards, alerts, and reporting.</li><li><strong>Data Management:</strong> Strong capability in troubleshooting data ingestion, parsing, and onboarding logs.</li><li><strong>API Integration:</strong> Experience using REST APIs for Splunk and third-party system integrations.</li><li><strong>Soft Skills:</strong> Strong problem-solving abilities, service-oriented mindset, and the ability to articulate technical concepts to non-technical audiences.</li></ul><p><strong>Desired/Preferred Qualifications</strong></p><ul><li><strong>Operating Systems:</strong> Advanced administration and troubleshooting skills in Unix/Linux and Windows environments.</li><li><strong>Scripting:</strong> Strong scripting skills in Bash, Python, JavaScript, SQL, or PowerShell for automation tasks.</li><li><strong>Cloud Platforms:</strong> Experience integrating Splunk with AWS, GCP, or Azure.</li><li><strong>Security Standards:</strong> Understanding of NIST, FISMA, and FedRAMP controls, as well as role-based access control (RBAC) implementation.</li><li><strong>Advanced Splunk Tools:</strong> Experience with the Splunk App for Data Science/Deep Learning, Splunk SOAR, or Splunk AI Assistant.</li><li><strong>Background:</strong> Previous experience in Cybersecurity, Network Administration, or Observability industries.</li></ul><p><br/></p> <h3>Skill(s)</h3> <ul><li>Splunk Enterprise Architecture &amp; Administration</li><li>Search Processing Language (SPL)</li><li>Linux/Unix System Administration</li><li>Python / Bash / PowerShell Scripting</li><li>REST API Integration</li><li>Cloud Infrastructure (AWS/Azure/GCP)</li><li>Data Ingestion &amp; Parsing</li><li>Cybersecurity Compliance (NIST/FISMA)</li><li>Splunk SOAR &amp; Automation</li></ul><p><br/></p> <h3>Benefits</h3> <ul><li>Insurance - health, dental, and vision</li><li>Paid Time Off (PTO) and 11 Federal Holidays</li><li>401(k) employer match</li></ul><p><br/></p> <h3>Travel</h3> None