SIEM Engineer

Overview

Splunk SIEM Specialist Engineer for Thomson Reuters’ SIEM & Security Analytics team, supporting Splunk and Enterprise Security deployments and partnering with SOC and related cyber functions.

What you'll do

• Monitor the stability of Splunk and the Enterprise Security SIEM platform.
• Create and optimize Splunk queries, dashboards, and reports for business and operational needs.
• Monitor environment health, troubleshoot issues, and tune platform performance.
• Troubleshoot ingestion delays, parsing errors, and search performance issues.
• Manage Splunk infrastructure in AWS and onboard new application/platform logs.
• Collaborate with SOC, CIRT, Threat Detection, and Cyber Intel teams to operationalize Splunk ES use cases.
• Embed automation into deployment and management of Splunk and Cribl infrastructure and maintain documentation.

What you'll need

• 5+ years’ experience with large hybrid Splunk deployments, including Splunk Cloud.
• Strong knowledge of Splunk and Cribl architecture and components.
• Proficiency in advanced SPL and dashboard creation.
• Experience with Splunk Enterprise Security (required).
• Experience integrating various data sources, including cloud.
• Experience with AWS or Azure or GCP cloud operations (preferred).
• General scripting proficiency (Bash, Python, regex, PowerShell, etc.).

Details

• Location: Bangalore, Karnataka, India (also listed as Bengaluru, Karnataka).
• Hybrid work model: 2–3 days/week in the office for office-based roles.