Cribl Engineer

Summary

Join True Zero Technologies, a veteran-owned small business and a Best Place to Work, as a consultant maintaining clients' Cribl and Splunk instances. You will be part of a team focused on Cribl pipeline development, parsing, tuning, and content enablement. The ideal candidate possesses relevant certifications and experience in managing production environments for these platforms, particularly within AWS. True Zero fosters collaboration and growth through knowledge sharing and provides access to a comprehensive knowledge base and internal resources. This role requires strong technical skills and experience with Splunk and Cribl, along with excellent communication and collaboration abilities. The position offers competitive compensation and benefits, including comprehensive health insurance, paid time off, 401k matching, and professional development opportunities.

Requirements

• Minimum Cribl Certified Admin Certification (or commensurate experience)
• Minimum Splunk Architect Certification (or commensurate experience)
• Proven experience in production environments for both Cribl and Splunk hosted in AWS environments
• Strong expertise in data parsing, pipeline development, and tuning within Cribl
• Deep understanding of Splunk architecture, data models, and advanced search techniques
• Expertise in implementing and supporting Splunk Enterprise Security use cases
• Ability to troubleshoot and resolve production issues in both Cribl and Splunk environments
• Collaborate with stakeholders to gather requirements and deliver tailored solutions
• Experience designing and implementing ground up Cribl installations
• Experience designing and implementing ground up distributed Splunk installations including all Splunk server roles (Search Head, Indexers, Heavy Forwarders and Universal Forwarders, etc.)
• Experience with advanced configuration of Splunk, including Indexer Clustering and Search Head Clustering
• Experience developing custom Splunk content including scheduled searches, reports, dashboards, etc
• Proficient at data on-boarding activities including custom parsing rules, custom Technology Add-On building according to Splunk's Common Information Model (CIM)
• Experience configuring indexes, index routing, retention policies, etc
• Experience working in linux and windows environments, ability to configure: Storage subsystems (I.e. partitioning, Volume Groups, Logical Volumes, etc.), SELinux
• Familiarity with different flavors of Linux distros (RedHat, CentOS, Ubuntu, etc.)
• File Permission Settings (linux/windows)
• Excellent written and oral skills, ability to work closely with multiple customers, manage expectations, and track engagement scope

Responsibilities

• Maintain various clients' Cribl and Splunk instances with a heavy emphasis on Cribl pipeline development, parsing, tuning, and content enablement in both Cribl and Splunk
• Manage and optimize production environments for Cribl and Splunk platforms
• Collaborate with stakeholders to gather requirements and deliver tailored solutions
• Troubleshoot and resolve production issues in both Cribl and Splunk environments

Preferred Qualifications

• Cribl Certified Service Consultant Certification
• Splunk Core Consultant Certification
• Splunk Enterprise Security Implementation Certification
• AWS Solutions Architect Associate/Professional (or commensurate experience)
• Knowledge of how to normalize data with Common Information Model (CIM) mappings
• Maintain compliance with security frameworks such as NIST, MITRE ATT&CK, and other regulatory standards
• Leverage AWS services such as S3, Kinesis, Lambda, EC2 and IAM for data ingestion and operational workflows
• Experience with risk-based alerting (RBA) and advanced correlation search strategies in Splunk ES
• Development and API experience (Python, Perl, XML)
• SaltStack, Ansible, and other enterprise automation tool experience
• Hardware experience and storage experience (SAN, NAS, etc.)
• U.S. Citizenship is required as this is in support of a Federal Customer

Benefits

• Competitive salary, paid twice per month
• Best in class medical coverage
• 100% of medical premiums covered by True Zero
• Company wide new business incentive programs
• Contribution Incentives (i.e. white papers, blog posts, internal webinars, etc.)
• 3 weeks of PTO starting + 11 Paid Holidays Annually
• 401k Program with 100% company match on the first 4%
• Monthly reimbursement of Cell Phone and Home Internet costs
• Paternity/Maternity Leave
• Investment in training and certifications to broaden and deepen your technical skills