Cyber & IT Operations Analytics Engineer

We are seeking a hands-on Cyber & IT Operations Data / Splunk Analytics Engineer to support the Sponsor’s IT systems data modernization ecosystem. In this role, you will address critical data challenges by establishing data quality baselines, schema standards, and normalization pipelines for high-velocity, disparate cyber feeds and IT operations telemetry (system performance metrics, service health, network infrastructure logs, and application events). Working within an Agile engineering environment, you will architect robust ingest pipelines, build optimized Splunk models and correlation searches, and ensure raw telemetry is transformed into standardized, high-confidence data powering both threat analysis and holistic IT operational health monitoring.

• Data Quality & Normalization: Standardize, cleanse, and normalize high-velocity machine data from disparate security tools and IT operational systems into common information schemas (e.g., Splunk CIM) to ensure data fidelity, search efficiency, and unified observability.
• Splunk Architecture & Operations: Configure, tune, monitor, and administer distributed Splunk infrastructure (Heavy Forwarders, Universal Forwarders, Indexer Clusters, Search Head Clusters) and ingest streams.
• Analytics & Search Optimization: Develop complex, performance-optimized Search Processing Language (SPL) queries, accelerated data models, event correlations, and real-time alerts supporting cyber threat detection and IT operational reliability/availability.
• Telemetry Pipeline Engineering: Design and support data routing, parsing, filtering, and transformation pipelines for logs, metrics, and traces using Splunk Forwarders, Syslog/HEC, or Apache NiFi.
• Observability & Dashboards: Build operational dashboards and reporting interfaces that translate security events and IT operational health/performance indicators into actionable insights for engineers and leadership.
• Ecosystem Integration: Collaborate with platform and cloud engineers to integrate clean, standardized cyber and IT operational datasets with downstream machine learning and automated analytics tooling.

Requirements

• Splunk Administrative Expertise: Hands-on experience deploying, architecting, managing, and optimizing distributed enterprise Splunk environments, including index management, forwarder configurations, search optimization, and data model acceleration.
• Cyber & IT Operations Telemetry Standards: Proven experience with log and metric telemetry (syslog, Windows Event Logs, network flows, application logs, infrastructure metrics), field extraction (⁠props.conf⁠ / ⁠transforms.conf⁠), and enforcing data quality and normalization standards across high-throughput data streams.
• Data Ingestion & Pipelines: Experience ingesting, parsing, and routing streaming data utilizing Splunk native inputs, HTTP Event Collector (HEC), Apache NiFi, or Kafka.
• Scripting & Automation: Ability to write scripts in Python, Bash, or JSON/REST APIs to automate data collection, pipeline health monitoring, and data sanitization tasks.
• Infrastructure & Enclave Environment: Solid working knowledge of Linux system administration, network connectivity troubleshooting, and secure cloud environments (e.g., AWS).
• Education & Experience: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent operational engineering experience).
• Must have an active TS/SCI with Polygraph Clearance.