Apply on Employer Site

True Zero Technologies · 1 month ago

Splunk Engineer-Core Certified Consultant/ ES Accreditation Required (R-00101)

United States

Full-time

Remote

Mid Level

True Zero Technologies is a veteran-owned small business focused on delivering top-tier services through a people-first approach. They are seeking a Splunk Engineer to develop and implement RBA strategies, create dashboards, and build custom solutions to enhance security operations within the organization.

Information ServicesInformation Technology

Responsibilities

Implement RBA: Develop and implement RBA strategies within Splunk ES to reduce alert noise and focus on high-fidelity alerts

Develop RBA components: Build and implement actionable alerts, workflow actions, risk incident rules, and risk scores

Create dashboards and reports: Design custom dashboards to visualize risk scores and provide context for analysts

Correlate data: Use Splunk's capabilities to correlate disparate events to identify patterns of risky behavior

Build custom solutions: Develop custom machine learning (ML) models to augment alerting and create automated workflows to improve efficiency

Content Development: Develop advanced security content, including dashboards, reports, and alerts, to highlight risk details, health analysis, and risk suppression specific to RBA environments

Data: Collaborate with application and system owners to onboard new data sources (e.g., from Windows, Linux, cloud services like AWS/Azure) and ensure proper parsing and enrichment for effective analysis within RBA

Correlate various data sources, such as logs from operating systems, applications, and cloud providers, into Splunk to feed RBA models