Splunk Data Analytics SME

SPLUNK DATA ANALYTICS SUBJECT MATTER EXPERT

ALTA IT Services has a contract-to-hire opening for a Splunk Data Analytics Subject Matter Expert to join a team of qualified, diverse individuals. This position will support a federal end customer, located in Woodlawn, MD. The position is day-to-day remote, with the potential for periodic onsite meetings. Candidates must reside in the Baltimore/DMV metro area.  

Due to the nature of the work US citizenship is required; with eligibility to obtain a public trust clearance.

This Splunk Data Analytic Subject Matter Expert (SME) will provide optimization of data flow using aggregation, filters, etc. The Splunk Data Analytic SME will be involved in the analysis of unstructured and semi-structured data, including latent semantic indexing (LSI), entity identification and tagging, complex event processing (CEP), and the application of analysis algorithms on distributed, clustered, and cloud-based high-performance infrastructures. The Subject Matter Expert will exercise creativity in applying non-traditional approaches to large-scale analysis of unstructured data in support of high-value use cases visualized through multi-dimensional interfaces. Handles processing and index requests against high-volume collections of data and high-velocity data streams. The candidate must have the ability to make discoveries in the world of big data. Requires strong technical and computational skills - engineering, physics, and mathematics, coupled with the ability to code design, develop, and deploy sophisticated applications using advanced unstructured and semi-structured data analysis techniques and utilizing high-performance computing environments.

The Splunk Data Analytic Subject Matter Expert must have the ability to utilize advanced tools and analytical skills to interpret, connect, predict, and make discoveries in complex data and deliver recommendations for business and analytic decisions.

Experience with cyber security application development, cyber security data collection tools, cyber security information and event management (SIEM) technology supports threat detection, compliance, and security incident management tools. Through the collection and analysis (both near real-time and historical) of security events, as well as a wide variety of other event and contextual data sources. The Splunk Data Analytic Subject Matter Expert should be proficient with recognizing and onboarding new data sources into Splunk, and Splunk Data Pipelines, analyzing the data for anomalies and trends, and building dashboards highlighting the key trends of the data. The Splunk engineer should be proficient within a Linux environment, editing and maintaining Splunk configuration files and apps.

DUTIES AND RESPONSIBILITIES:

·        Create a consolidated data set that conforms to the common information model made up of sensor data sources that are already aggregated together and are also already searchable.

·        Develop the capability to aggregate all sensor data results based on two main categories: “tangible assets, namely hardware, software, and data” and “Information Systems, groups of assets with a business purpose.”

·        Develop the capability to tag new data so that it falls into the Re-Usable data assets model so that IO and CDM dashboards can ingest them.

·        Create a way to translate key-value pairs from any sensor tools into the format needed to be consumed.

·        Transform already good data into the format needed for ingestion by Xacta.IO and CDM Elastic file.

·        Create a data pipeline and create connections between the data source(s) and the Re-Usable data asset model.

·        Create a connection between Splunk and the Re-Usable data asset model.

·        Establish Xacta.IO data pipeline connection with the Re-Usable data asset model.

·        Establish CDM Elastic data pipeline connection with the Re-Usable data asset model.

·        Develop an integrator between Splunk and Xacta.IO and CDM Elastic.

·        Buildout Data Warehouses/ data models:

·        Tag Data

·        Buildout data pipelines in Splunk

·        Establish data pipeline connections.

·        Develop Integrators/Integrations (between Splunk, DB Connect, Splunk, Xacta)

·        Aggregate various types of data

·        Create Key-Value pairs.

·        ETL coding

·        Buildout Dashboards

·        Configure notable event actions, action menus, and Adaptive Responses.

·        Data onboarding and data ingestion normalization recommendations.

·        Strong knowledge of security risk procedures, security patterns, authentication technologies and security attack pathologies.

·        Develop, evaluate, and document, specific metrics for management purposes.

·        Create Dashboards to monitor the traffic volumes, response times, errors, and warnings across various data centers.

·        Monitor the web portals, log files, and databases.

·        Design and Develop Splunk for routine use.

·        Solve complex Integration challenges and debug complex configuration issues.

·        Consult with stakeholders to establish, maintain, and refresh their strategic direction in cloud adoption.

·        Become knowledgeable on the CDM technical requirements for the federal government’s CDM program. Understand your

·        role in CDM activities.

·        Involved in a wide range of security issues including architectures, firewalls, electronic data traffic, and network access.

·        Design, manage, and maintain enterprise SIEM infrastructure to improve data ingestion processes, including architectural work on data pipelines to ensure optimal flow of data.

BASIC QUALIFICATIONS:

·        Bachelor’s degree and 7 years of experience, Master's degree and 5 years of experience, or 11 years of experience instead of a degree

·        At least 4 years of experience using a customer focused Splunk Data Pipelining SIEM engineering background.

·        At least 4 years of experience in a senior Splunk role working in a Splunk clustered environment supporting SOC or NOC environments.

·        At least 4 years of experience with:

·        In-depth knowledge of designing, upgrading, maintaining, and implementing network devices on a large-scale enterprise

·        Direct experience with Splunk Engineering and data integration

·        Prior SIEM data modeling experience on a similar platform at scale (>50 servers)

·        Scripting and development skills in Python/Perl with a deep comprehension of regular expressions

·        Coordination and communication with other remotely deployed team members

·        Developing documentation with processes and procedures

·        Proposing, and implementing automation features in a large enterprise environment

·        At least 3 years of experience with Linux and SQL/ODBC interfaces

·        At least 2 years of experience with data transport and transformation APIs and technologies such as JSON, XML, XSLT, JDBC, SOAP, and REST.

·        Hold active Splunk Core Certifications of at least Splunk Architect

·        Minimum of 3 years of experience in developing and tailoring reporting from network security tools.

·        Must be able to obtain and maintain a US Public Trust clearance.

PREFERRED QUALIFICATIONS:

·        Candidates with these skills will be given preferential consideration.

·        Experience with Splunk Common Information Model (CIM) and Enterprise Analytics.

·        Strong problem-solving abilities with an analytic and qualitative eye for reasoning under pressure.

·        Self-starter with the ability to independently prioritize and complete multiple tasks with little to no supervision.

·        Knowledge of Cloud Services such as AWS, Azure, Office365.

·        Ability to script in one more of the following computer languages Python, Bash, Visual Basic, or PowerShell.

·        Experience in automating Splunk Deployments and orchestration within a Cloud environment.

HOURLY RATE: $65/HR. W2. Benefits available.

For consideration, please contact Melissa McNally via mmcnally@altaits.com

ALTA IT Services is an owned subsidiary of System One, a leading provider of specialized workforce solutions and integrated services. ALTA is an established leader in IT Staffing and Services, for both government and commercial enterprises across the United States, specializing in Program & Project Management, Application Development, Cybersecurity, Data & Advanced Analytics, and Agile Transformation Services. ALTA IT Services is an equal opportunity/affirmative action employer that considers qualified applicants for employment without regard to race, gender, age, color, religion, disability, veteran status, sexual orientation, or any other factor.