Principal Infrastructure Engineer - Splunk Admin (SIEM)

FC Global Services India LLP (First Citizens India), a part of First Citizens BancShares, Inc., a top 20 U.S. financial institution, is a global capability center (GCC) based in Bengaluru. Our India-based teams benefit from the company’s over 125-year legacy of strength and stability. First Citizens India is responsible for delivering value and managing risks for our lines of business. We are particularly proud of our strong, relationship-driven culture and our long-term approach, which are deeply ingrained in our talented workforce. This is evident across all key areas of our operations, including Technology, Enterprise Operations, Finance, Cybersecurity, Risk Management, and Credit Administration. We are seeking talented individuals to join us in our mission of providing solutions fit for our clients’ greatest ambitions.

Job Description:

Job Description

Value Proposition

Responsible for enterprise-wide observability and monitoring initiative. Responsible to build, and implementing standardized data onboarding pipelines and configurations to bring applications into Splunk Enterprise and Splunk Enterprise Security platforms.

Job Details

Position Title: Principal Infrastructure Engineer

Career Level: P4

Job Category: Assistant Vice President

Role Type: Hybrid

Job Location: Bangalore

About the Role:

Seeking expert Splunk Admins for a critical enterprise-wide observability and monitoring initiative. This role is essential in designing, building, and implementing standardized data onboarding pipelines and configurations to bring applications into Splunk Enterprise and Splunk Enterprise Security platforms. Success demands both technical depth and the ability to work at a rapid pace while maintaining high quality and consistency.

Key Deliverables

• •Design and implement standardized data onboarding procedures and configurations for applications; establish repeatable patterns and templates
• •Conduct technical onboarding of applications into Splunk Cloud: configure data inputs, create parsing rules, establish field extractions, and build data models
• •Map application data and security events to Splunk Common Information Model (CIM); identify and document relevant SIEM use cases
• •Build and optimize data models, lookups, and knowledge objects to support reporting, alerting, alerting rule creation, and compliance requirements
• •Design and implement automated onboarding pipelines using Git-based configuration management, Ansible playbooks, and CI/CD workflows to reduce manual effort and improve consistency
• •Establish and enforce standardized tagging conventions, naming standards, and data organization principles across all onboarded applications
• •Collaborate with Business Analysts to translate requirements into technical specifications; support requirements clarification and feasibility assessment
• •Work alongside Splunk Data Admins to execute onboarding at scale; establish code review and peer collaboration practices to maintain quality
• •Provide consultation to Splunk users and stakeholder teams on best practices, use cases, and guidance for creating and maintaining knowledge objects
• •Deliver training and knowledge-sharing sessions to Enterprise Monitoring Team and partner IT teams on standardized onboarding procedures and platform capabilities
• •Integrate Splunk with complementary monitoring and infrastructure platforms (Dynatrace, SolarWinds) to ensure cohesive observability workflows
• •Serve as primary technical point of contact for complex Splunk platform issues during the engagement period; support incident response as needed in collaboration with client's operations team
• •Monitor Splunk platform health and performance; proactively identify and resolve bottlenecks, optimization opportunities, and infrastructure constraints
• •Correlate and reconcile disparate events and data sources from multiple monitoring platforms to ensure consistent, reliable alerting and reporting
• •Troubleshoot and resolve complex data integration challenges; identify data quality issues, reconciliation gaps, and root causes
• •Document technical architecture, configuration decisions, onboarding procedures, and lessons learned to enable knowledge transfer and future maintenance
• •Participate in ongoing optimization and performance tuning as volume and complexity increase throughout the engagement

Skills and Qualification

• •Advanced Splunk Enterprise and Splunk Cloud administration
• •Strong knowledge of data models, data model accelerations, and knowledge objects
• •Deep understanding of Common Information Model (CIM) and data normalization principles
• •Experience with advanced search optimization, lookup tables, and automated lookups
• •Proficiency with Splunk Enterprise Security (ES) platform and SIEM use cases
• •Knowledge of Splunk Cloud-specific features, limitations, and best practices
• •Understanding of Splunk licensing, data ingestion pipelines, and performance tuning
• •Hands-on experience designing and implementing data ingestion pipelines
• •Expertise in log parsing, data transformation, and field extraction
• •Strong proficiency with Git version control and collaborative development workflows (branching, pull requests, code reviews)
• •Hands-on experience with Ansible for infrastructure automation and configuration management
• •Experience with CI/CD pipelines and automated deployment processes
• •Scripting and automation using Python, Bash, or similar languages
• •Understanding of SIEM platforms and security event management workflows
• •Knowledge of common security use cases (authentication, access control, threat detection, incident response)
• •Familiarity with compliance frameworks (SOX, PCI-DSS, HIPAA) and audit trail requirements
• •Desired to have knowledge of complementary observability platforms (Dynatrace, SolarWinds, Prometheus, Elastic)
• •Minimum 3+ years of hands-on Splunk Enterprise administration and implementation experience
• •Minimum 10+ years of infrastructure, platform engineering, systems administration, or related technical domain experience
• •Splunk Certified Admin (SCA), Splunk Certified Power User (SCPU) and Splunk ES certification or coursework completed required; additional Splunk certifications (e.g., SCS, Developer) preferred
• •Excellent oral and written communication skills as well as positive, customer-focused interpersonal skills and attitude
• •Excellent collaboration skills, ownership & accountability
• •Financial Services/Banking experience, Large Financial Institution (LFI) (or similarly complex environment) preferred
• •BE or MCA Degree in computer science or related field

Relationships & Collaboration

• •Reports to: Associate Director
• •Partners: Cross-functional teams across geographies ( US team)

Accessibility Needs

We are committed to providing an inclusive and accessible hiring process. If you require accommodations at any stage (e.g. application, interviews, onboarding) please let us know, and we will work with you to ensure a seamless experience.

Equal Employment Opportunity

FC Global Services India LLP (First Citizens India) is an Equal Employment Opportunity Employer. We are committed to fostering an inclusive and accessible environment and prohibit all forms of discrimination on the basis of gender, religion, caste, disability, sexual orientation, economic status or any other characteristics protected by the law. We strive to foster a safe and respectful environment in which all individuals are treated with respect and dignity. Our EEO policy ensures fairness throughout the employee life cycle.