As a SIEM Platform Engineer, you will be responsible for engineering, maintaining, and continuously improving our enterprise SIEM platform.
Your work will directly support our security operations by ensuring a reliable, scalable, and high‑quality SIEM foundation.
This is a hands‑on engineering position - not a SOC analyst role.
Role insights:
- Maintain and improve Splunk Enterprise components (Search Heads, Indexers, Cluster Masters, Deployment Servers).
- Manage and optimize heavy forwarders and universal forwarders for reliable log ingestion.
- Onboard new data sources across cloud, on-prem, and hybrid environments.
- Develop and maintain TAs, props/transforms, field extractions, and parsing logic.
- Ensure CIM-compliant data models and well-structured, high-quality logs.
- Support troubleshooting across ingestion, parsing, indexing, search performance, and configuration issues.
- Ensure platform stability, performance, and security.
- Handle platform upgrades, scaling activities, and architecture enhancements.
- Work with internal teams to document integrations and maintain onboarding quality.
- Work closely with SOC analysts, threat hunters, and detection engineers to ensure data readiness.
- Contribute to internal engineering standards, guidelines, and best practices.
- Automate deployments, maintenance tasks, and data onboarding workflows (Python, Bash, Ansible, or similar).
- Build scripts and tools that improve the platform’s efficiency and reduce manual work.
- Support SOAR automation pipelines where needed.
What makes you unique:
- Bachelor’s or Master’s degree in Information Security, Computer Science, or related field.
- 3–5+ years of hands‑on experience administering and engineering Splunk Enterprise/SIEM platforms.
- Strong hands-on experience with Splunk Enterprise as a platform engineer/admin.
- Expertise in: Deployment servers, Heavy forwarders, Parsing and filtering, TA/APP development, Data onboarding at scale.
- Solid understanding of: Linux, Networking fundamentals, Logging architectures.
- Scripting skills (Python preferred).
- Experience in cybersecurity/SIEM environments.
- Familiarity with cloud environments (especially Azure/M365) is a plus.
- Splunk certifications (Admin, Architect, Core, ES Analyst) are a strong advantage.
- German language skills will be considered as an advantage.
Our gratitude for the job done will be eternal, but we’ll also offer you:
- Valuable experience in one of the fastest-growing and most innovative industries.
- Challenging assignments with strong opportunities for personal and professional growth in a multinational environment.
- Hybrid working model supporting a healthy work-life balance.
- Thousands of online and in-person Learning opportunities for you to grow.
- Modern, open, and friendly work environment that fosters continuous learning and the development of both technical and soft skills.
- Special employee tariffs and a wide range of attractive employee benefits.
If you have any questions, please do not hesitate to contact Svetlina Vazharova.
