Splunk SOC Analyst

Job Title: Splunk Analyst SOC Admin

Location: Pune

About the Company:

Gruve is an innovative Software Services startup dedicated to empowering Enterprise Customers in managing their Data Life Cycle. We specialize in Cyber Security, Customer Experience, Infrastructure, and advanced technologies such as Machine Learning and Artificial Intelligence. Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Why Gruve:

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If youre passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.

Position summary:

The Splunk Administrator is responsible for managing and optimizing the organization's Splunk environment. This role involves configuring, maintaining, and troubleshooting Splunk systems, ensuring data integrity, and providing insights through Splunk dashboards and reports. The ideal candidate will have a strong background in IT and cybersecurity, with hands-on experience in Splunk administration.

Key Responsibilities:

Splunk Management and Administration:

1. Perform sizing of ennviornment based on customer enviornment.
2. Install, configure, and manage Splunk instances and clusters.
3. Perform regular maintenance and updates to Splunk systems.
4. Perform configuration of search head, forwarder & heavy forwarder.
5. Ensure high availability and performance of Splunk environments.

Data Ingestion and Integration:

1. Onboard data sources and configure data inputs.
2. Develop and maintain data parsing and indexing processes.
3. Integrate Splunk with various log sources and other monitoring tools.
4. Develop apps to integrate non-supported devices/application.

Monitoring and Troubleshooting:

1. Monitor the health and performance of Splunk systems.
2. Conduct regular performance tuning, capacity planning, and system audits.
3. Troubleshoot and resolve Splunk-related issues.
4. Perform root cause analysis for system failures and performance issues.

Security and Compliance:

1. Implement and maintain security best practices within the Splunk environment.
2. Ensure compliance with relevant regulatory requirements and internal policies.
3. Develop and enforce Splunk access controls and user permissions.

Dashboard and Report Development:

1. Create and maintain custom dashboards, alerts, and reports.
2. Work with stakeholders to identify requirements and deliver actionable insights.
3. Optimize searches and reports for performance and efficiency.

Documentation, Training and Support:

1. Document system configurations, SOPs, and troubleshooting procedures.
2. Provide training and guidance to Level 1 and Level 2 support staff.
3. Collaborate with IT and security teams to ensure seamless integration of Splunk.
4. Keep documentation up-to-date with changes and best practices.

Other Knowledge Base:

1. Should possess hands-on knowledge with Linux OS & Windows OS.
2. Should have basic to mediator level knowledge in Networking skills.
3. Possess knowledge in scripting like Python.
4. Good to have knowledge in AWS, Azure or GCP

Required Qualification & Expertise

1. Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
2. Proven experience as a Splunk Administrator or similar role.
3. Expertise in managing Splunk Enterprise, Splunk Cloud, and associated apps.
4. Strong understanding of Splunk architecture, components, and configurations.
5. Proficiency in Splunk Search Processing Language (SPL).
6. Experience with data ingestion, parsing, and indexing in Splunk.
7. Knowledge of IT infrastructure, networking, and cybersecurity principles.
8. Excellent problem-solving skills and attention to detail.
9. Strong communication and interpersonal skills.

Preferred Qualifications:

1. Splunk Core Certified Power User, Splunk Enterprise Certified Admin or Splunk Certified Architect certification.
2. Experience with scripting languages (e.g., Python, Bash) for automation.
3. Familiarity with other SIEM tools and security technologies.
4. Experience in a regulated industry (e.g., finance, healthcare).