Splunk Architect

We are seeking a skilled and experienced Splunk Architect to design, implement, and manage enterprise-scale Splunk solutions across cloud and on-prem environments. The ideal candidate will have a deep understanding of Splunk architecture and be capable of leading deployment strategies, data onboarding, and integrations in a complex IT environment.Key Responsibilities:Design and implement scalable, resilient, and secure Splunk Enterprise and Splunk ES/ITSI architectures.Lead Splunk infrastructure planning, upgrades, and clustering strategies.Onboard and normalize logs from systems including Windows, Linux, firewalls, cloud services (AWS/Azure/GCP), and application logs.Develop dashboards, alerts, reports, and KPIs for IT operations, SOC teams, and business stakeholders.Integrate Splunk with third-party tools (e.g., ServiceNow, Jira, AWS CloudWatch, SOAR tools).Perform system tuning, data retention strategy planning, and storage management.Define and implement correlation rules, SPL queries, and CIM-compliant data models.Provide architectural consulting to internal teams and mentor junior engineers.Ensure best practices for security monitoring, compliance, and incident response workflows.Required Skills & Qualifications:Bachelor's or Master's degree in Computer Science, IT, or related field.7+ years of IT experience, with 5+ years of hands-on Splunk experience.Expertise in:Splunk deployment architecture (Indexer clusters, Search Head clusters, Heavy Forwarders, Deployment Servers)SPL (Search Processing Language)CIM and data onboardingSecurity and compliance use cases (e.g., SOC, NIST, GDPR, ISO 27001)Experience with cloud platforms: AWS, Azure, or GCP.Strong knowledge of regex, data parsing, Linux/Unix, and networking protocols.Automation/scripting experience with Python, Shell, or Ansible preferred.Certifications (Preferred):Splunk Certified ArchitectSplunk Certified AdminSplunk Enterprise Security CertifiedAny relevant cloud certifications (AWS/Azure)