Consultant Cyber Splunk

Project overview

Context and objective of the mission

Our cybersecurity specialized service company is expanding its technical team and is looking for a Splunk Admin Expert whose core competency lies in log collection and the use of the CIM model.

The mission revolves around a guiding principle: making the chain that transports data to Splunk reliable and industrialized. Specifically, this involves architecting, tuning, and optimizing the performance of this chain, so that logs from the various IT system environments are ingested reliably, quickly, and with controlled security.

Project details

• Start: ASAP
• Duration: 6 mois
• Location: 95700 ROISSY-EN-FRANCE, FR
• Languages: French

Scope of intervention

The assigned activities are divided between building the collection, industrializing deployment, and leveraging the data:

Data collection and transport

Configuration and processing

Industrialization, performance, and security

• Design and operate log collection mechanisms in Splunk.
• Administer and maintain Heavy Forwarders (HF), Universal Forwarders (UF), HEC, and DBConnect in operational conditions.
• Take charge of Splunk configuration files: inputs.conf, props.conf, transforms.conf, and indexes.conf.
• Design and evolve parsers to effectively structure incoming data.
• Leverage the CIM (Common Information Model) and Splunk Technology Add-ons (TA).
• Work on ingestion and indexing performance.
• Ensure data quality compatible with searches, alerting, and security uses.

Profile sought

The position is for a consultant with an expert Splunk profile, who has already proven their skills in log collection and exploitation in complex technical contexts. Beyond technical skills, real autonomy and a taste for working with multidisciplinary teams make the difference.

Expected strengths:

• Solid and proven experience in Splunk administration.
• Mastery of Splunk collection architectures and all their components.
• Ease in environments with very high data volumes.
• A keen understanding of supervision, cybersecurity, and data reliability challenges.
• The ability to combine autonomous work with collaboration with various technical teams.

Essential technical skills

Two structuring prerequisites frame the mission: the expected Splunk administration at an expert level, and the CIM model at a confirmed level — these two points being imperative.

Around this foundation, the position requires:

• Good mastery of Universal Forwarders and Heavy Forwarders.
• Configuration of various collection sources: TCP / UDP streams, files, scripts, and databases via DBConnect.
• Mastery of Splunk configuration files: inputs.conf, props.conf, transforms.conf, and indexes.conf.
• Understanding of indexing mechanisms and associated optimization levers.
• Confirmed practice in managing large log volumes.
• Good knowledge of Splunk Technology Add-ons (TA).

Work environment

The intervention takes place on a high-volume Splunk platform, supported by a team dedicated to log collection, exploitation, and leveraging. The context is characterized by high demands for performance, security, and availability, and by close collaboration with infrastructure teams and SOC analysts.