Job Requirements
Remote
Public Trust Polygraph not specified
Mid Level Career (5+ yrs experience)
Salary not specified
Join Premium to unlock estimated salaries 
Job Description
Description
CyKor is a fast-growing Technology Solutions Provider to both federal and commercial clients. We attribute our continued growth to our core values, our professional team, and the valuable relationships with our clients. Our small and growing team fosters an environment in which each team member is respected, valued, and appreciated for their contributions.
The Lead Splunk Architect is responsible for defining, governing, and leading the architecture, implementation, optimization, and operational maturity of the enterprise Splunk platform supporting cybersecurity operations, threat detection, incident response, compliance, and enterprise observability.
ROLE & RESPONSIBILITIES
Splunk Architecture & Platform Strategy
Define and architect enterprise Splunk architecture supporting high availability, scalability, resilience, disaster recovery, and long-term growth
Design and oversee distributed Splunk environments including: Indexer Clusters, Search Head Clusters, Deployment Servers, Cluster Managers, Heavy Forwarders, Universal Forwarders, License Management, Splunk Cloud and Hybrid architectures
Develop technical roadmaps, modernization strategies, migration plans, and platform lifecycle recommendations
Evaluate current platform capabilities and recommend architectural improvements supporting SOC operations and enterprise cybersecurity initiatives
Technical Leadership
Serve as the technical lead for all Splunk engineering activities
Provide mentorship and technical direction to Splunk Engineers, Security Engineers, Detection Engineers, and SOC Analysts
Review architecture, engineering designs, implementation plans, dashboards, searches, integrations, and custom applications
Establish engineering standards and best practices across index naming, Sourcetypes, CIM compliance, field extractions, knowledge objects, configuration management, change control, application lifecycle management, role-based access control
Platform Engineering & Operations
Architect scalable and resilient Splunk infrastructure supporting enterprise data volumes
Lead platform optimization including Search performance, Index performance, Storage management, Retention policies, License utilization, Data lifecycle management, Search concurrency, Data Model Acceleration
Guide upgrades, patching, backup, disaster recovery, and high availability planning
Lead troubleshooting of complex ingestion, parsing, indexing, search, and performance issues
Data Engineering & Integration
Define enterprise data onboarding strategies across security, infrastructure, cloud, identity, endpoint, network, and application data sources
Oversee parsing, routing, index design, field extraction, source normalization, CIM implementation, retention policies, data quality
Lead integrations with firewalls, IDS/ IPS, EDR, NDR, Identity providers, Cloud platforms, Vulnerability management, Ticketing systems, SIEM and SOAR technologies, Threat Intelligence platforms
Security Operations Enablement
Architect Splunk capabilities supporting Threat Detection, Threat Hunting, Incident Response, Security Monitoring, Risk-Based Alerting, Compliance Reporting
Guide development of Correlation Searches, Dashboards, Reports, Data Models, Detection Content,
Enterprise Security Content
Improve detection fidelity while reducing false positives
Ensure Splunk capabilities support rapid investigation, evidence collection, event reconstruction, and executive reporting
Splunk SOAR & Automation
Architect automation strategies using Splunk SOAR
Design and oversee playbooks for Incident enrichment, IOC validation, Threat intelligence lookups, Malware analysis, Case management, Automated containment, Notification workflows
Integrate SOAR with enterprise security technologies using Python, REST APIs, and supported applications
Establish automation governance and reusable orchestration standards
Governance & Quality Assurance
Establish engineering governance for Configuration Management, App Lifecycle, Knowledge Object Management, Detection Content, Source Onboarding, Dashboard Standards
Review deployment packages and engineering deliverables prior to production release
Ensure engineering activities comply with change management, testing, documentation, rollback, and operational readiness requirements
Stakeholder Engagement
Serve as the primary technical advisor for Splunk architecture and platform strategy
Communicate technical risks, roadmap priorities, and architectural recommendations to executive leadership and program stakeholders
Translate business and mission requirements into scalable technical solutions
Coordinate activities with infrastructure, cloud, networking, identity, cybersecurity, and vendor teams
Documentation & Continuous Improvement
Develop and maintain Architecture diagrams, Engineering standards, Technical designs, Runbooks, Standard Operating Procedures, Disaster Recovery documentation, Knowledge Base articles, Technical decision records
Evaluate emerging Splunk capabilities and recommend improvements to maximize platform value
Foster engineering excellence through mentorship, standards, and continuous process improvement
Requirements
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or related field; equivalent professional experience may be substituted.
8+ years of enterprise Splunk administration and engineering experience
5+ years designing enterprise-scale distributed Splunk environments
Experience leading Splunk Enterprise Security implementations
Experience with Splunk Cloud and hybrid architectures
Experience supporting Security Operations Centers (SOC)
Experience leading technical teams and architecture initiatives
Experience with enterprise cybersecurity monitoring and incident response
Active security clearance strongly preferred (Public Trust or higher)
CERTIFICATIONS:
Required: Splunk Enterprise Certified Architect
Preferred: Splunk Enterprise Security Certified Admin; Splunk Core Certified Consultant; Splunk SOAR Certified Automation Developer; CISSP; GIAC (GCIA, GCIH, or GCED); AWS, Azure, or Google Cloud certifications
LOCATION AND TRAVEL:
Remote schedule with availability for some related travel (0%-25%)
CyKor is a fast-growing Technology Solutions Provider to both federal and commercial clients. We attribute our continued growth to our core values, our professional team, and the valuable relationships with our clients. Our small and growing team fosters an environment in which each team member is respected, valued, and appreciated for their contributions.
The Lead Splunk Architect is responsible for defining, governing, and leading the architecture, implementation, optimization, and operational maturity of the enterprise Splunk platform supporting cybersecurity operations, threat detection, incident response, compliance, and enterprise observability.
ROLE & RESPONSIBILITIES
Splunk Architecture & Platform Strategy
Define and architect enterprise Splunk architecture supporting high availability, scalability, resilience, disaster recovery, and long-term growth
Design and oversee distributed Splunk environments including: Indexer Clusters, Search Head Clusters, Deployment Servers, Cluster Managers, Heavy Forwarders, Universal Forwarders, License Management, Splunk Cloud and Hybrid architectures
Develop technical roadmaps, modernization strategies, migration plans, and platform lifecycle recommendations
Evaluate current platform capabilities and recommend architectural improvements supporting SOC operations and enterprise cybersecurity initiatives
Technical Leadership
Serve as the technical lead for all Splunk engineering activities
Provide mentorship and technical direction to Splunk Engineers, Security Engineers, Detection Engineers, and SOC Analysts
Review architecture, engineering designs, implementation plans, dashboards, searches, integrations, and custom applications
Establish engineering standards and best practices across index naming, Sourcetypes, CIM compliance, field extractions, knowledge objects, configuration management, change control, application lifecycle management, role-based access control
Platform Engineering & Operations
Architect scalable and resilient Splunk infrastructure supporting enterprise data volumes
Lead platform optimization including Search performance, Index performance, Storage management, Retention policies, License utilization, Data lifecycle management, Search concurrency, Data Model Acceleration
Guide upgrades, patching, backup, disaster recovery, and high availability planning
Lead troubleshooting of complex ingestion, parsing, indexing, search, and performance issues
Data Engineering & Integration
Define enterprise data onboarding strategies across security, infrastructure, cloud, identity, endpoint, network, and application data sources
Oversee parsing, routing, index design, field extraction, source normalization, CIM implementation, retention policies, data quality
Lead integrations with firewalls, IDS/ IPS, EDR, NDR, Identity providers, Cloud platforms, Vulnerability management, Ticketing systems, SIEM and SOAR technologies, Threat Intelligence platforms
Security Operations Enablement
Architect Splunk capabilities supporting Threat Detection, Threat Hunting, Incident Response, Security Monitoring, Risk-Based Alerting, Compliance Reporting
Guide development of Correlation Searches, Dashboards, Reports, Data Models, Detection Content,
Enterprise Security Content
Improve detection fidelity while reducing false positives
Ensure Splunk capabilities support rapid investigation, evidence collection, event reconstruction, and executive reporting
Splunk SOAR & Automation
Architect automation strategies using Splunk SOAR
Design and oversee playbooks for Incident enrichment, IOC validation, Threat intelligence lookups, Malware analysis, Case management, Automated containment, Notification workflows
Integrate SOAR with enterprise security technologies using Python, REST APIs, and supported applications
Establish automation governance and reusable orchestration standards
Governance & Quality Assurance
Establish engineering governance for Configuration Management, App Lifecycle, Knowledge Object Management, Detection Content, Source Onboarding, Dashboard Standards
Review deployment packages and engineering deliverables prior to production release
Ensure engineering activities comply with change management, testing, documentation, rollback, and operational readiness requirements
Stakeholder Engagement
Serve as the primary technical advisor for Splunk architecture and platform strategy
Communicate technical risks, roadmap priorities, and architectural recommendations to executive leadership and program stakeholders
Translate business and mission requirements into scalable technical solutions
Coordinate activities with infrastructure, cloud, networking, identity, cybersecurity, and vendor teams
Documentation & Continuous Improvement
Develop and maintain Architecture diagrams, Engineering standards, Technical designs, Runbooks, Standard Operating Procedures, Disaster Recovery documentation, Knowledge Base articles, Technical decision records
Evaluate emerging Splunk capabilities and recommend improvements to maximize platform value
Foster engineering excellence through mentorship, standards, and continuous process improvement
Requirements
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or related field; equivalent professional experience may be substituted.
8+ years of enterprise Splunk administration and engineering experience
5+ years designing enterprise-scale distributed Splunk environments
Experience leading Splunk Enterprise Security implementations
Experience with Splunk Cloud and hybrid architectures
Experience supporting Security Operations Centers (SOC)
Experience leading technical teams and architecture initiatives
Experience with enterprise cybersecurity monitoring and incident response
Active security clearance strongly preferred (Public Trust or higher)
CERTIFICATIONS:
Required: Splunk Enterprise Certified Architect
Preferred: Splunk Enterprise Security Certified Admin; Splunk Core Certified Consultant; Splunk SOAR Certified Automation Developer; CISSP; GIAC (GCIA, GCIH, or GCED); AWS, Azure, or Google Cloud certifications
LOCATION AND TRAVEL:
Remote schedule with availability for some related travel (0%-25%)
group id: 91173057