Splunk Architect and SOC Solutions Engineer, Lead

Key Role:

Support our various government clients. Lead engagements focused on assessment, architecture, and deployment of enterprise-scale Splunk solutions, including operational development and providing oversight for a Splunk log management infrastructure. Help manage Splunk, an equivalent hardware infrastructure, and oversee production support. Provide architecture-level design to support and operate Splunk using Security Information and Event Management (SIEM) or Security Event Management (SEM) best practices and Splunk enterprise security. Manage customer expectations, help onboard data into Splunk, support projects in multi-site or clustered Splunk installations, and assist with the development of advanced KPIs and metrics to meet the requirements of key stakeholders. Conduct research in areas driven by customer use cases, architect and support systems used to configure and deploy solutions. Assist with the automation, deployment, integration, and testing of enterprise systems and services and create and optimize Big Data correlations as a Splunk search language (SPL) expert.

Basic Qualifications:

• 3+ years of experience with Splunk administration and architecture, including Splunk components, such as Splunk Enterprise Security (ES) and Splunk User and Entity Behavior Analytics (UEBA)

• 3+ years of experience with Splunk development and Splunk components such as indexer, search head, forwarder, or deployment server

• 5+ years of experience in IT infrastructure, networking, architecture, administration, or security

• Experience with customer interaction and data onboarding, configuration, and optimization in Splunk

• Knowledge of security operations service capabilities, including monitoring, detection, and analysis, incident response, solutions architecture, engineering, and tool deployment, integration, and support

• Public Trust

• Bachelor's degree in Computer Science, Information Systems, Information Assurance, Engineering, or Business

Additional Qualifications:

• Experience working in a fast-paced, security operations center, promptly responding to critical mission needs as needed

• Experience with contributing to technical proposal responses and technical white papers

• Experience with Linux shell scripting, Python, and Regex

• Experience with security tools, including Firewall, IDS, Active Directory, Nmap, Burp, Proxy, Bro, or Endpoint technologies

• Knowledge of networking protocols

• Knowledge of the integration of threat intelligence, threat hunt, forensics, and malware analysis into security operations

• Ability to communicate with management and other technical subject matter experts and operators

• Splunk Certified Architect, Splunk Enterprise Security Certified Admin, or Comp TIA CISSP Certification

Vetting:

Applicants selected will be subject to a government investigation and may need to meet eligibility requirements of the U.S. government client; Public Trust determination is required.

Compensation

At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen's benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.

Identity Statement

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Work Model
Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.

• If this position is listed as remote or hybrid, you'll periodically work from a Booz Allen or client site facility.
• If this position is listed as onsite, you'll work with colleagues and clients in person, as needed for the specific role.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.