We are seeking a skilled Splunk Engineer to join our cybersecurity and observability team. The candidate should have hands-on experience managing the complete Splunk lifecycle, including migrations, platform optimization, use case development, and deep integration with EDR/XDR and SOAR platforms such as SentinelOne and Cisco XDR.
Requirements
- Bachelor's degree in Computer Science, Information Security, or related field
- Strong experience with Splunk Enterprise and/or Splunk Cloud (SaaS), including architecture, deployment, and migrations
- Hands-on experience integrating SentinelOne EDR/XDR with SIEM platforms (Splunk), including API-based ingestion and alert correlation
- Solid understanding of endpoint security concepts, malware behavior, ransomware detection, lateral movement, and persistence techniques
- Experience with Wazuh, UEBA, AI/ML-driven analytics, and security data enrichment
- Proficiency in log ingestion, indexing, SPL searches, dashboards, correlation rules, alerts, and knowledge objects
- Experience with Splunk Enterprise Security (ES) and risk-based alerting models
- Hands-on experience ingesting and analyzing AWS cloud security logs in Splunk
- Familiarity with Cisco security ecosystem, including Umbrella, Secure Firewall, Secure Endpoint, Cisco XDR, SOAR playbooks, SecureX
- Understanding of networking, operating systems (Windows/Linux), and SOC operations
- Splunk certifications (Core, ES, Cloud Admin) and SentinelOne or XDR-related certifications are a strong plus
- Desired Experience: 3–5 years of experience in Splunk administration, security engineering, or SOC analytics
Benefits
- Competitive remuneration package
- Support, coaching, and feedback from engaging colleagues
- Opportunities to develop new skills and progress your career
- Freedom and flexibility to handle your role in a way that’s right for you
- EY is committed to being an inclusive employer and we are happy to consider flexible working arrangements