Lead Splunk Architect

CyKor is a fast-growing Technology Solutions Provider to both federal and commercial clients. We attribute our continued growth to our core values, our professional team, and the valuable relationships with our clients. Our small and growing team fosters an environment in which each team member is respected, valued, and appreciated for their contributions.

The Lead Splunk Architect is responsible for defining, governing, and leading the architecture, implementation, optimization, and operational maturity of the enterprise Splunk platform supporting cybersecurity operations, threat detection, incident response, compliance, and enterprise observability.

ROLE & RESPONSIBILITIES

Splunk Architecture & Platform Strategy

• Define and architect enterprise Splunk architecture supporting high availability, scalability, resilience, disaster recovery, and long-term growth
• Design and oversee distributed Splunk environments including: Indexer Clusters, Search Head Clusters, Deployment Servers, Cluster Managers, Heavy Forwarders, Universal Forwarders, License Management, Splunk Cloud and Hybrid architectures
• Develop technical roadmaps, modernization strategies, migration plans, and platform lifecycle recommendations
• Evaluate current platform capabilities and recommend architectural improvements supporting SOC operations and enterprise cybersecurity initiatives

Technical Leadership

• Serve as the technical lead for all Splunk engineering activities
• Provide mentorship and technical direction to Splunk Engineers, Security Engineers, Detection Engineers, and SOC Analysts
• Review architecture, engineering designs, implementation plans, dashboards, searches, integrations, and custom applications
• Establish engineering standards and best practices across index naming, Sourcetypes, CIM compliance, field extractions, knowledge objects, configuration management, change control, application lifecycle management, role-based access control

Platform Engineering & Operations

• Architect scalable and resilient Splunk infrastructure supporting enterprise data volumes
• Lead platform optimization including Search performance, Index performance, Storage management, Retention policies, License utilization, Data lifecycle management, Search concurrency, Data Model Acceleration
• Guide upgrades, patching, backup, disaster recovery, and high availability planning
• Lead troubleshooting of complex ingestion, parsing, indexing, search, and performance issues

Data Engineering & Integration

• Define enterprise data onboarding strategies across security, infrastructure, cloud, identity, endpoint, network, and application data sources
• Oversee parsing, routing, index design, field extraction, source normalization, CIM implementation, retention policies, data quality
• Lead integrations with firewalls, IDS/ IPS, EDR, NDR, Identity providers, Cloud platforms, Vulnerability management, Ticketing systems, SIEM and SOAR technologies, Threat Intelligence platforms

Security Operations Enablement

• Architect Splunk capabilities supporting Threat Detection, Threat Hunting, Incident Response, Security Monitoring, Risk-Based Alerting, Compliance Reporting
• Guide development of Correlation Searches, Dashboards, Reports, Data Models, Detection Content, Enterprise Security Content
• Improve detection fidelity while reducing false positives
• Ensure Splunk capabilities support rapid investigation, evidence collection, event reconstruction, and executive reporting

Splunk SOAR & Automation

• Architect automation strategies using Splunk SOAR
• Design and oversee playbooks for Incident enrichment, IOC validation, Threat intelligence lookups, Malware analysis, Case management, Automated containment, Notification workflows
• Integrate SOAR with enterprise security technologies using Python, REST APIs, and supported applications
• Establish automation governance and reusable orchestration standards

Governance & Quality Assurance

• Establish engineering governance for Configuration Management, App Lifecycle, Knowledge Object Management, Detection Content, Source Onboarding, Dashboard Standards
• Review deployment packages and engineering deliverables prior to production release
• Ensure engineering activities comply with change management, testing, documentation, rollback, and operational readiness requirements

Stakeholder Engagement

• Serve as the primary technical advisor for Splunk architecture and platform strategy
• Communicate technical risks, roadmap priorities, and architectural recommendations to executive leadership and program stakeholders
• Translate business and mission requirements into scalable technical solutions
• Coordinate activities with infrastructure, cloud, networking, identity, cybersecurity, and vendor teams

Documentation & Continuous Improvement

• Develop and maintain Architecture diagrams, Engineering standards, Technical designs, Runbooks, Standard Operating Procedures, Disaster Recovery documentation, Knowledge Base articles, Technical decision records
• Evaluate emerging Splunk capabilities and recommend improvements to maximize platform value
• Foster engineering excellence through mentorship, standards, and continuous process improvement

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or related field; equivalent professional experience may be substituted.
• 8+ years of enterprise Splunk administration and engineering experience
• 5+ years designing enterprise-scale distributed Splunk environments
• Experience leading Splunk Enterprise Security implementations
• Experience with Splunk Cloud and hybrid architectures
• Experience supporting Security Operations Centers (SOC)
• Experience leading technical teams and architecture initiatives
• Experience with enterprise cybersecurity monitoring and incident response
• Active security clearance strongly preferred (Public Trust or higher)

CERTIFICATIONS:

Required: Splunk Enterprise Certified Architect

Preferred: Splunk Enterprise Security Certified Admin; Splunk Core Certified Consultant; Splunk SOAR Certified Automation Developer; CISSP; GIAC (GCIA, GCIH, or GCED); AWS, Azure, or Google Cloud certifications

LOCATION AND TRAVEL:

• Remote schedule with availability for some related travel (0%-25%)