Data and Splunk Engineer - Officer

Overview

An individual contributor role supporting enterprise cybersecurity observability and analytics, combining Splunk engineering (about 30%) with data engineering and data science on Databricks (about 70%).

What you'll do

• Design, develop, optimize and maintain Splunk SPL searches, dashboards, reports, alerts, data models, field extractions, lookups, macros and reusable knowledge objects.
• Build and enhance security observability solutions across endpoint, web proxy, firewall, network, identity, cloud, vulnerability, threat intelligence and other enterprise telemetry.
• Onboard and validate new data sources, covering source analysis, parsing, normalization, timestamp validation, field mapping, data quality and search readiness.
• Troubleshoot ingestion failures, telemetry gaps, latency, duplication, parsing issues, search failures and dashboard performance concerns.
• Improve Splunk performance using efficient SPL, data model acceleration, summary indexing, lookup optimization and appropriate search scheduling.
• Develop proactive monitoring and alerting for Splunk platform health, ingestion volumes, search execution, dashboard availability and operational service levels.
• Partner with SOC, threat intelligence, detection engineering, security platform and data teams to improve detection readiness and operational analytics.
• Design and maintain scalable data ingestion and transformation pipelines using Python, SQL, PySpark, Databricks, Delta Lake and cloud services.
• Build curated, analytics-ready datasets with strong controls for data quality, reconciliation, lineage, observability, testing and performance.
• Integrate Splunk and Databricks workflows to support telemetry enrichment, historical analytics, aggregation and downstream reporting.
• Perform exploratory analysis and feature engineering to identify trends, anomalies, relationships and risk indicators across cybersecurity datasets.
• Develop or support statistical and machine-learning use cases including anomaly detection, classification, clustering, prioritization and entity correlation.
• Operationalize analytics through Git, CI/CD, automated testing, workflow orchestration, monitoring, documentation and production support.
• Create technical documentation, dashboard guides, data dictionaries, operational runbooks and knowledge-sharing materials.
• Mentor junior engineers, contribute to peer reviews, and promote reusable engineering and analytics practices.

What you'll need

• Approximately 10 years of professional experience across Splunk engineering, security analytics, data engineering, data science, cybersecurity, cloud or related technology disciplines.
• Bachelor's degree in computer science, information technology, data science, statistics, mathematics, engineering, cybersecurity or a related discipline, or equivalent professional experience.
• Demonstrated hands-on experience with Splunk engineering and advanced SPL in an enterprise environment.
• Strong hands-on expertise in Splunk, including advanced SPL, dashboards, alerts, reports, data models, field extractions, lookups, macros and performance optimization.
• Experience with enterprise-scale log ingestion, security telemetry onboarding, data validation, troubleshooting and operational monitoring.
• Hands-on experience with Python, SQL, PySpark, Databricks or comparable data platforms, ETL/ELT and large-scale data processing.
• Strong programming and data engineering skills using Python, SQL, PySpark, Databricks, ETL/ELT, Delta Lake and distributed processing.
• Understanding of Lakehouse architecture, data modeling, orchestration, data quality, reconciliation, lineage, observability and pipeline optimization.
• Practical knowledge of statistical analysis and machine-learning concepts such as feature engineering, anomaly detection, classification, clustering and model evaluation.
• Understanding of cybersecurity data and workflows, including SIEM/SOAR, threat detection, endpoint telemetry, vulnerability data, identity events, incidents and threat intelligence.
• Experience working with cloud platforms, preferably AWS or Azure, and with Git-based version control and CI/CD practices.
• Ability to independently own technical deliverables, resolve complex issues, collaborate across teams and communicate effectively with technical and senior stakeholders.
• Strong analytical, troubleshooting, documentation and stakeholder communication skills.

Nice to have

• Experience within a SOC, threat detection, threat intelligence, security operations or cybersecurity analytics environment.
• Experience with Cribl or similar telemetry routing, shaping, enrichment and pipeline technologies.
• Knowledge of security data normalization, MITRE ATT&CK concepts, incident enrichment, detection engineering and SIEM/SOAR workflows.
• Exposure to MLflow, MLOps, Generative AI, LLMs, embeddings, vector search, RAG, NLP or graph analytics.
• Experience with Power BI or equivalent visualization and reporting technologies.
• Experience in financial services, regulated industries, or environments with strong privacy, governance, security and audit requirements.
• Relevant Splunk, Databricks, cloud, data engineering, data science or cybersecurity certifications.

Details

• Location: Bangalore, India.
• Individual contributor role.