Senior Splunk Consultant

TeraSky is a global technology solution integrator specializing in AI, Cloud, DevOps platforms and Data. Since 2010, we have helped more than 1,000 organizations adopt advanced technologies through over 4,000 complex deployments, including Kubernetes platforms, modern data environments, and Generative AI solutions. Our team of 300+ experts works closely with leading technology partners, including AWS, Microsoft, Google, and VMware, to design, implement, and operate scalable enterprise environments. If you’re excited about working with leading experts, modern technologies, and complex, high-impact projects, TeraSky offers an environment where you can grow and make a real impact 🚀 We are looking for a Senior Splunk Consultant to serve as the main technical delivery authority for our Splunk practice. You will lead hands-on delivery for enterprise customers, from platform architecture and data onboarding to Splunk Enterprise Security, security integrations and platform optimization. Depending on project needs, you will also support SOAR, observability, SIEM migrations and security proofs of concept. As a trusted technical advisor, you will guide customers across on-premises, cloud and hybrid environments, translate business and security needs into practical solutions, and help define technical standards for the practice. You will contribute to presales discussions, solution scoping and delivery estimates, combining deep technical expertise with clear communication. Customer self-sufficiency is central to the role. Through documentation, workshops and mentoring, you will equip customer teams to operate, troubleshoot, tune and evolve their Splunk environments independently.

Responsibilities:
• Design, implement and optimize Splunk Enterprise and Splunk Cloud Platform environments, including architecture, sizing, retention, performance tuning and troubleshooting.
• Deliver Splunk Enterprise Security solutions, including data onboarding, CIM normalization, MITRE ATT&CK-aligned detections, risk-based alerting, dashboards and reports.
• Automate deployments and integrate security and ITSM platforms; support solution scoping, technical documentation, workshops and customer knowledge transfer.

Requirements:
• 5+ years of hands-on Splunk experience in production, including 2+ years with Splunk Enterprise Security.
• Proven experience designing and managing distributed Splunk environments, including search heads, indexers, forwarders, capacity planning and retention configuration.
• Hands-on experience implementing and configuring Splunk Enterprise Security, including correlation searches, MITRE ATT&CK-aligned detections, risk-based alerting, and asset and identity enrichment.
• Strong SPL, CIM and data onboarding skills, including props/transforms, field extractions, forwarders, HEC and syslog.
• Experience optimizing Splunk and ES performance, including search tuning, data model acceleration, search scheduling and concurrency, and detection tuning to reduce false positives.
• Solid cybersecurity and networking knowledge, including Windows / Active Directory and Microsoft Entra ID security logs; hands-on experience with Linux and at least one major cloud provider
- AWS, Azure or GCP.
• Strong analytical, troubleshooting and customer-facing skills
• scripting skills in Python, Bash or PowerShell, and deployment/configuration automation experience with Terraform or Ansible.
• Familiarity with Splunk AI Assistant and Splunk MCP Server for search, investigation and operational workflows
- advantage.
• Relevant Splunk certifications, or experience with SIEM migrations, SOAR playbooks, Edge/Ingest Processor, observability solutions or CI/CD
- advantage.