Splunk Admin-

Splunk platform management, including administration, monitoring, and performance optimization. Onboarding of additional log sources into Splunk via Cribl in accordance with defined requirements. Log source optimization within Cribl, including filtering, routing, and data transformation for efficiency and cost optimization.

Continuous monitoring and management of SIEM platform health, ensuring availability and performance. Troubleshooting and resolution of connectivity issues impacting SIEM data ingestion and integrations. Prepare and deliver management reports at agreed frequencies (daily, weekly, monthly, or as defined).

Log review and parsing activities performed on a need basis to support security monitoring and use case requirements. Development and refinement of Splunk use cases, aligned with SOC, Application Teams and Client inputs to enhance detection capabilities and overall security posture. Generation and tracking of monthly environment performance and process efficiency metrics.

Vendor coordination and support management for Splunk and Cribl-related issues, enhancements, and escalations.