Strength. Care. Growth
You will know we are the right place for you, if you are driven by:
- Opportunities to learn and build your career.
- Meaningful work in a stable and fast-paced company.
- Diversity of people, projects, and platforms.
- A supportive, fun, and inspiring place to work.
This job can be performed by all countries within our A1 footprint.
Role Overview:
As a SIEM Platform Engineer, you will be responsible for engineering, maintaining, and continuously improving our enterprise SIEM platform.
Your work will directly support our security operations by ensuring a reliable, scalable, and high?quality SIEM foundation.
This is a hands?on engineering position - not a SOC analyst role.
Role insights:
- Maintain and improve Splunk Enterprise components (Search Heads, Indexers, Cluster Masters, Deployment Servers).
- Manage and optimize heavy forwarders and universal forwarders for reliable log ingestion.
- Onboard new data sources across cloud, on-prem, and hybrid environments.
- Develop and maintain TAs, props/transforms, field extractions, and parsing logic.
- Ensure CIM-compliant data models and well-structured, high-quality logs.
- Support troubleshooting across ingestion, parsing, indexing, search performance, and configuration issues.
- Ensure platform stability, performance, and security.
- Handle platform upgrades, scaling activities, and architecture enhancements.
- Work with internal teams to document integrations and maintain onboarding quality.
- Work closely with SOC analysts, threat hunters, and detection engineers to ensure data readiness.
- Contribute to internal engineering standards, guidelines, and best practices.
- Automate deployments, maintenance tasks, and data onboarding workflows (Python, Bash, Ansible, or similar).
- Build scripts and tools that improve the platform’s efficiency and reduce manual work.
- Support SOAR automation pipelines where needed.
What makes you unique:
- Bachelor’s or Master’s degree in Information Security, Computer Science, or related field.
- 3–5+ years of hands?on experience administering and engineering Splunk Enterprise/SIEM platforms.
- Strong hands-on experience with Splunk Enterprise as a platform engineer/admin.
- Expertise in: Deployment servers, Heavy forwarders, Parsing and filtering, TA/APP development, Data onboarding at scale.
- Solid understanding of: Linux, Networking fundamentals, Logging architectures.
- Scripting skills (Python preferred).
- Experience in cybersecurity/SIEM environments.
- Familiarity with cloud environments (especially Azure/M365) is a plus.
- Splunk certifications (Admin, Architect, Core, ES Analyst) are a strong advantage.
- German language skills will be considered as an advantage.
Job code: AIT070P210
Job classification:P2 - 10, KV4, PT 3/1
