Provide centralized oversight and authoritative governance of all Splunk knowledge objects across the enterprise SIEM environment, including saved searches, correlation searches, field extractions, tags, aliases, event types, lookups, macros, data models, workflow actions, and KV store collections.
Establish, publish, and enforce enterprise-wide naming conventions for all knowledge object types — ensuring consistent, parseable, and discoverable naming across teams, apps, and deployments.
Conduct regular audits of knowledge object libraries to identify duplicate, orphaned, deprecated, or conflicting objects — retiring obsolete content and consolidating redundant objects across teams and deployments.
Create custom automations to track the ingest of data, the consistent flow of the data, drift of data away from the normalization standards, etc.
Define and maintain a knowledge object registry/catalog that documents ownership, scope, purpose, permissions, and lifecycle stage for each object in the environment.
Collaborate enterprise Splunk platform teams on permission structures and sharing models — ensuring objects are accessible to the correct roles (read/write/execute) across apps, environments, and user tiers without overexposure.
Lead the promotion pipeline for knowledge objects from development through testing, staging, and production — establishing change control workflows aligned to CI/CD and GitOps practices (GitHub, GitHub Actions).
CIM Normalization & Data Model Management
Serve as the CIM (Common Information Model) authority for the enterprise — defining and maintaining CIM-compliant field mappings across all ingested data sources including endpoints (EDR/AV), network (firewall, proxy, DNS), identity (IAM, AD), cloud (AWS CloudTrail, Azure Monitor, GCP Logging), and application layers.
Design, build, and maintain Splunk data models for Pivot users, ES correlation searches, and accelerated reporting — ensuring alignment to CIM schemas and ES asset/identity frameworks.
Manage data model acceleration strategies (TSIDX, tstats, summary indexing) across all production data models, monitoring for search load, acceleration lag, and coverage gaps.
Define and enforce source-type and index taxonomy standards — establishing lexicographic naming conventions that optimize search performance, configuration priority, and multi-team usability.
Ensure entity zone enrichment (asset zones, network zones, identity tiers) is properly incorporated into data models and asset/identity lookups, supporting tiered risk scoring in Enterprise Security.
Maintain CIM coverage matrices across all logging domains, mapping data model fields to MITRE ATT&CK techniques, detection use cases, and compliance controls.
Knowledge Architecture & Standards Program
Design and own the enterprise Splunk knowledge architecture — defining taxonomy hierarchies, content type standards, metadata schemas, and classification frameworks that enable findability, scalability, and governance across all teams.
Develop and maintain a Knowledge Management Standards document (published to internal wiki/SharePoint) covering naming conventions, object lifecycle stages, ownership models, permission templates, CIM mapping standards, and change control procedures.
Establish and chair a Knowledge Governance Working Group composed of representatives from Detection Engineering, SOC Operations, Platform Engineering, Compliance, and key application teams — meeting regularly to review standards, resolve conflicts, and prioritize improvements.
Define content type templates for correlation searches, dashboards, reports, lookups, and macros — providing reusable, pre-approved scaffolding that accelerates new content development while enforcing standards compliance.
Required Technical Skills & Technologies
Splunk Core
Splunk Enterprise (distributed, multi-site, clustered) deep administrative and engineering proficiency
Agile / Scrum methodology for iterative content development
Required Qualifications
Bachelor’s degree in computer science, Information Systems, Cybersecurity, or equivalent professional experience
8+ years of hands-on Splunk experience in enterprise environments
3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day)
Deep expertise in Splunk Enterprise Security — correlation search authoring, ES data models, risk-based alerting
Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments
Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development
Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments
Proven ability to create and maintain technical documentation — runbooks, standards guides, architecture documentation
Background in detection engineering, threat hunting, or SOC operations — understanding of how knowledge objects serve analysts in practice
Preferred Qualifications
Splunk Certifications: Splunk Core Certified Consultant, Splunk Enterprise Security Certified Admin (SPLK-3001), Splunk Certified Architect — one or more strongly preferred
Security Certifications: GIAC (GCIA, GCIH, GCED), or equivalent
Experience with Splunk SOAR (Phantom) playbook development, orchestration, and knowledge integration
Familiarity with Splunk UBA and behavioral analytics model management
Experience in healthcare or highly regulated industries (HIPAA, Federal (NIST), NYDFS, PCI)
Experience with infrastructure-as-code tools (Ansible, Terraform) for Splunk configuration management
Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval and content management
Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention