Splunk Performance & Content Engineer

Overview

Splunk Performance & Content Engineer responsible for optimizing search performance and designing, maintaining and tuning Splunk content across security, IT operations and application monitoring, working alongside ACSC App/Dev under the agreed RACI split.

What you'll do

• Optimize search performance across the 1,117 scheduled searches, including SPL tuning, data models and summary indexing.
• Tune Splunk and application settings for performance, scalability and reliability, in line with the RACI split with ACSC App/Dev.
• Remediate data-quality issues including parsing, sourcetype, index and volume problems.
• Monitor system health and search performance trends and report findings in the monthly service report.
• Tune ITSI KPIs and episodes during ACSC business hours.
• Work down the backlog in the agreed priority order and report weekly burn-down during transition.
• Maintain knowledge articles and runbooks for search and content work.
• Attend the daily stand-up (09:15 PT) and biweekly planning and retrospective sessions, representing Shift B at ACSC ceremonies.
• Receive and hand over work in progress during the 05:00-06:00 PT warm handover.
• Design and maintain dashboards, reports, alerts, correlation searches and detection rules for security, IT operations and application monitoring.
• Develop and maintain CIM-compliant data models, field extractions, lookups, event types and tags.
• Package content into apps and manage it through version control and CI/CD (content lifecycle, testing, release).
• Map detections to frameworks such as MITRE ATT&CK and reduce false positives through regular content tuning.
• Work with SOC, SRE and application teams to gather requirements and turn them into actionable content.
• Analyze and optimize SPL, including slow searches, expensive dashboards and inefficient scheduled searches.
• Tune data model acceleration, summary indexing, report acceleration and search scheduling to reduce load.
• Monitor platform performance with the Monitoring Console and internal logs (search concurrency, skipped searches, indexing latency, queue blocking, resource usage).
• Optimize ingestion through sourcetype and props/transforms tuning, event filtering and index design.
• Establish search and content standards, review peer content and educate users on efficient SPL.
• Report on content quality, search performance and license/storage trends, and recommend capacity improvements.

What you'll need

• BA/BS degree and 8+ years' relevant experience OR equivalent combination of education and experience.
• Over 7 years of experience on Advanced SPL, including data models, accelerated searches and summary indexing.
• Search and scheduler performance analysis: skew, concurrency, search quotas and resource use.
• Data onboarding and normalization: props, transforms, CIM mapping.
• Experience tuning ITSI services, KPIs and episodes.
• Ability to work with application and dashboard owners without owning dashboard design (ACSC App/Dev remains responsible).
• Clear written and spoken English; comfortable overlapping the ACSC working day (Pacific Time).

Nice to have

• Splunk Certified Power User, Admin or Architect.
• Splunk Observability Cloud and OpenTelemetry exposure.
• Scripting for automation (Python or Bash).
• Experience working a backlog in a Kanban or sprint model.
• Experience with Splunk Enterprise Security, ITSI or Observability Cloud.
• Knowledge of detection engineering practices and MITRE ATT&CK.
• Experience with Dashboard Studio, REST APIs and the Splunk SDK.

Details

• Location: Bangalore, KA, India.
• Works the ACSC business day in Pacific Time, including the 05:00-06:00 PT warm handover and 09:15 PT daily stand-up.