Security Operations Engineer - Splunk/Cribl

Fulcrum are seeking a highly skilled Security Operations Engineer with hands-on experience in Splunk and Cribl to join a client of ours on a full time direct hire basis. In this role, you will be responsible for enhancing the organization's security operations by designing, implementing, and managing log aggregation, threat detection, and data flow processes. Your expertise will contribute to ensuring the integrity, confidentiality, and availability of systems and data.
Key Responsibilities:
Security Monitoring & Analytics:
Manage and optimize Splunk environments to support security monitoring, incident detection, and response.
Develop, maintain, and fine-tune Splunk dashboards, alerts, and reports for comprehensive visibility.
Data Pipeline Management:
Use Cribl to route, reduce, and enrich logs for efficient ingestion into Splunk and other SIEMs.
Design and maintain scalable log aggregation pipelines, ensuring data quality and relevance.
Threat Detection & Incident Response:
Collaborate with the SOC and incident response teams to create custom detection rules, playbooks, and threat-hunting queries.
Identify and address gaps in security monitoring by integrating new data sources into Splunk.
System Maintenance & Performance:
Ensure optimal performance of Splunk and Cribl systems by implementing best practices and regular updates.
Troubleshoot and resolve issues in log ingestion, processing, and storage workflows.
Collaboration & Training:
Work closely with IT, DevOps, and application teams to onboard critical data sources.
Provide training and documentation to junior analysts and stakeholders on Splunk and Cribl usage.
Qualifications:
Required Skills:
Technical Expertise:
Proficient in configuring and managing Splunk Enterprise and Splunk Cloud.
Hands-on experience with Cribl LogStream for log parsing, routing, and enrichment.
Strong scripting skills (e.g., Python, Bash) for automation and custom integrations.
Security Knowledge:
Familiarity with security frameworks such as NIST, MITRE ATT&CK, or ISO 27001.
Experience with log analysis, SIEM configurations, and incident response processes.
Operational Excellence:
Proven ability to optimize data ingestion pipelines and manage large-scale log environments.
Strong problem-solving skills and the ability to operate under pressure during incidents.
Preferred Skills:
Familiarity with additional log management tools (e.g., Elastic, Graylog).
Knowledge of cloud environments (e.g., AWS, Azure, GCP) and their logging services.
Certifications such as Splunk Certified Admin, Cribl Certified Administrator, or CISSP.
Education & Experience:
Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent work experience).
3+ years of experience in security operations, with a focus on log management and monitoring tools.

Work arrangement
Yes