Data and Splunk Engineer - Officer

Job Description

Data Engineer / Data Scientist/ Splunk Engineer , Officer

Role Level

Officer

Role Type

Individual Contributor

Focus Area

Data Engineering & Data Science

Skill Mix

70% Data Engineering / Data Science; 30% Splunk Engineering

Experience Target

Approximately 10 years

Who we are looking for

The Data Engineer / Data Scientist/ Splunk Engineer , Officer, will support enterprise cybersecurity observability and analytics by combining deep Splunk engineering expertise with scalable data engineering and applied data science capabilities. The role is weighted (70%) towards Databricks-based data engineering, advanced analytics, and practical machine-learning solutions that convert complex security telemetry into reliable, actionable intelligence. The remaining focus(30%) towards Splunk engineering, with responsibility for developing searches, dashboards, alerts, data models, telemetry onboarding, and platform monitoring.

What you will be responsible for

As a Data Engineer / Data Scientist / Splunk Engineer , you will:

· Design, develop, optimize, and maintain Splunk SPL searches, dashboards, reports, alerts, data models, field extractions, lookups, macros, and reusable knowledge objects.

· Build and enhance security observability solutions across endpoint, web proxy, firewall, network, identity, cloud, vulnerability, threat intelligence, and other enterprise telemetry.

· Onboard and validate new data sources, covering source analysis, parsing, normalization, timestamp validation, field mapping, data quality, and search readiness.

· Troubleshoot ingestion failures, telemetry gaps, latency, duplication, parsing issues, search failures, and dashboard performance concerns.

· Improve Splunk performance using efficient SPL, data model acceleration, summary indexing, lookup optimization, and appropriate search scheduling.

· Develop proactive monitoring and alerting for Splunk platform health, ingestion volumes, search execution, dashboard availability, and operational service levels.

· Partner with SOC, threat intelligence, detection engineering, security platform, and data teams to improve detection readiness and operational analytics.

· Design and maintain scalable data ingestion and transformation pipelines using Python, SQL, PySpark, Databricks, Delta Lake, and cloud services.

· Build curated, analytics-ready datasets with strong controls for data quality, reconciliation, lineage, observability, testing, and performance.

· Integrate Splunk and Databricks workflows to support telemetry enrichment, historical analytics, aggregation, and downstream reporting.

· Perform exploratory analysis and feature engineering to identify trends, anomalies, relationships, and risk indicators across cybersecurity datasets.

· Develop or support practical statistical and machine-learning use cases including anomaly detection, classification, clustering, prioritization, and entity correlation.

· Operationalize analytics through Git, CI/CD, automated testing, workflow orchestration, monitoring, documentation, and production support.

· Create clear technical documentation, dashboard guides, data dictionaries, operational runbooks, and knowledge-sharing materials.

· Mentor junior engineers, contribute to peer reviews, and promote reusable engineering and analytics practices.

What we value

These skills will help you succeed in this role:

· Strong hands-on expertise in Splunk, including advanced SPL, dashboards, alerts, reports, data models, field extractions, lookups, macros, and performance optimization.

· Experience with enterprise-scale log ingestion, security telemetry onboarding, data validation, troubleshooting, and operational monitoring.

· Strong programming and data engineering skills using Python, SQL, PySpark, Databricks, ETL/ELT, Delta Lake, and distributed processing.

· Understanding of Lakehouse architecture, data modeling, orchestration, data quality, reconciliation, lineage, observability, and pipeline optimization.

· Practical knowledge of statistical analysis and machine-learning concepts such as feature engineering, anomaly detection, classification, clustering, and model evaluation.

· Understanding of cybersecurity data and workflows, including SIEM/SOAR, threat detection, endpoint telemetry, vulnerability data, identity events, incidents, and threat intelligence.

· Ability to independently own technical deliverables, resolve complex issues, collaborate across teams, and communicate effectively with technical and senior stakeholders.

· Strong focus on automation, documentation, operational excellence, governance, scalability, resiliency, and measurable outcomes.

Education & Qualifications

Minimum Qualifications

· Approximately 10 years of professional experience across Splunk engineering, security analytics, data engineering, data science, cybersecurity, cloud, or related technology disciplines.

· Bachelor's degree in computer science, information technology, data science, statistics, mathematics, engineering, cybersecurity, or a related discipline, or equivalent professional experience.

· Demonstrated hands-on experience with Splunk engineering and advanced SPL in an enterprise environment.

· Hands-on experience with Python, SQL, PySpark, Databricks or comparable data platforms, ETL/ELT, and large-scale data processing.

· Experience working with cloud platforms, preferably AWS or Azure, and with Git-based version control and CI/CD practices.

· Strong analytical, troubleshooting, documentation, and stakeholder communication skills.

Preferred Qualifications

· Experience within a SOC, threat detection, threat intelligence, security operations, or cybersecurity analytics environment.

· Experience with Cribl or similar telemetry routing, shaping, enrichment, and pipeline technologies.

· Knowledge of security data normalization, MITRE ATT&CK concepts, incident enrichment, detection engineering, and SIEM/SOAR workflows.

· Exposure to MLflow, MLOps, Generative AI, LLMs, embeddings, vector search, RAG, NLP, or graph analytics.

· Experience with Power BI or equivalent visualization and reporting technologies.

· Experience in financial services, regulated industries, or environments with strong privacy, governance, security, and audit requirements.

· Relevant Splunk, Databricks, cloud, data engineering, data science, or cybersecurity certifications.

Technical Skills

Skill Area

Expected Capabilities

Splunk Engineering

Advanced SPL, dashboards, reports, alerts, data models, field extractions, lookups, macros, onboarding, troubleshooting, optimization and platform monitoring.

Data Engineering

Python, SQL, PySpark, Databricks, ETL/ELT, Delta Lake, Lakehouse, data modeling, orchestration, data quality, lineage and observability.

Data Science / ML

Exploratory analysis, feature engineering, anomaly detection, classification, clustering, model evaluation and explainability.

Cloud & DevOps

AWS or Azure, Git, CI/CD, automated testing, scalable processing, workflow monitoring and production support.

Cybersecurity Analytics

Security telemetry, SIEM/SOAR, threat detection, endpoint and network data, vulnerability, identity, incident and threat intelligence datasets.

Visualization & Reporting

Splunk dashboards, Power BI or equivalent tools, operational metrics, trend analysis and stakeholder reporting.

Additional Requirements

· This is an individual contributor role with strong cross-functional collaboration and mentoring expectations.

· The role requires sound judgment when working with sensitive cybersecurity, risk, operational, and regulated data.

· The candidate should be comfortable balancing hands-on Splunk delivery, production data engineering, applied analytics, and stakeholder communication.

Why this role is important to us

Cybersecurity depends on complete, reliable, and searchable telemetry supported by scalable data engineering and effective analytics. This role bridges Splunk Engineering,