{"id":152841,"url":"https://alion.io/job/abbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2","title":"Splunk / Cribl Engineer - Cybersecurity Engineering (Hybrid)","company":{"id":3660,"name":"AbbVie","domain":"abbvie.com","url":"https://alion.io/company/abbvie","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":80,"open_postings":68,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":16,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chicago, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":84500,"max":162000,"currency":"USD","period":"year","gross":null,"usd_annual":162000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"ETL/ELT","optional":false},{"name":"Exabeam","optional":false},{"name":"Git","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-07-31T16:33:55Z","employer_posted_date":"2026-07-31","last_verified_at":"2026-10-29T20:11:04Z","board_verified":true,"closed_at":null,"days_open":90,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":90},"description":"About AbbVie\nAbbVie's mission is to discover and deliver innovative medicines and solutions that solve serious health issues today and address the medical challenges of tomorrow. We strive to have a remarkable impact on people's lives across several key therapeutic areas including immunology, oncology, and neuroscience - and products and services in our Allergan Aesthetics portfolio. For more information about AbbVie, please visit us at www.abbvie.com. Follow @abbvie on LinkedIn, Facebook, Instagram, X and YouTube.\n As a member of the Cyber Security Engineering (CSE) team within Information Security & Risk Management (ISRM), the Data Engineer focuses on expanding data capabilities. This role is responsible for delivering high-value data management solutions, including data pipelines, models, and SIEM platform optimization, to empower analysts and protect the business.\nResponsibilities:\nData Pipeline Development: Design, implement, and enhance robust streaming and batch data pipelines utilizing message brokers to efficiently feed the SIEM and other downstream analytics engines. \nData Transformation & Normalization: Leverage observability pipelines to aggressively route, filter, and normalize/harmonize data, creating structured datasets from unstructured logs prior to SIEM ingestion. \nData Modeling & Architecture: Build scalable data models and enhance standard schemas within data warehousing solutions to deliver reliable, cost-effective, query-optimized storage. \nData Integrity & Lineage: Verify data integrity and translations across distributed systems and message topics while managing end-to-end data lineage. \nDevelopment & Integration: Analyze requirements to determine the necessary coding, API integrations, and programming activities to connect disparate security telemetry sources into the SIEM, data warehouses, or other repositories. \nTesting & Quality Assurance: Execute testing plans, debug pipeline routing issues, and thoroughly document data flows, routing configurations, and integration protocols. \nData Management Operations: Perform the compilation, cataloging, caching, and rapid retrieval of telemetry within the SIEM and associated data lakes. \nAnalytics Toolsets: Create, manage, and support advanced analytics and reporting environments operating outside the primary SIEM for long-term security analytics and hunting. \nRequirements & Capacity Planning: Define precise data specifications and proactively plan for capacity changes across streaming, routing, indexing, and storage infrastructure. \nGovernance & Standards: Assist in developing, documenting, and enforcing comprehensive data ingestion standards, parsing policies, and retention procedures across all supported platforms. \nActionable Insights: Analyze diverse data sources across the data stack to uncover trends, improve data quality, and provide actionable recommendations to the security operations team. \nMetrics Automation: Develop standards and implement robust automations for metrics aggregation and dissemination, pulling key telemetry from the SIEM and data warehouses. \n Required:\nBachelor's Degree with 5 years' experience; or Master's Degree with 4 years' experience\nExperienced in writing and optimizing Splunk’s Search Processing Language (SPL) \nProven ability to administer Splunk Enterprise and onboard data sources \nSkills in developing data models, dictionaries, and reports within a SIEM platform \nExperience building and configuring data pipelines \nExperience with regular expressions and parsing unstructured data \nDeep understanding of data administration and data standardization policies \nKnowledge of database management systems, query languages, table relationships, and views \nExperience in validating data sets and calculations \nAbility to work both independently without direction and within a group for day-to-day activities \nCapable of learning new concepts and processes quickly, and adapting to a constantly changing environment \nExperience with CI/CD Pipelines and Git \nExperience with database & system integration technologies \nPreferred:\nSplunk Certified Admin, Power User, or Architect certification \nPrior experience working in an Agile team \nFamiliarity with cybersecurity, privacy principles, cyber threats, and vulnerabilities \nPrior experience working with ETL in a SIEM environment (ELK, Splunk, Exabeam, etc.) \nExperience working with development tools and scripting languages (Python / PowerShell / Go) \nExperience analyzing and pivoting on large sets of data, with the ability to identify patterns, anomalies, and outliers \nCribl Certified User, Admin Stream, or Engineer \nDemonstrated experience in log analysis and parsing of unstructured data (ETL) \nAmazon Solutions Architect / Azure Data Engineer Associate / Cloud Professional Data Engineer Certification \n Applicable only to applicants applying to a position in any location with pay disclosure requirements under state or local law:\nThe compensation range described below is the range of possible base pay compensation that the Company believes in good faith it will pay for this role at the time of this posting based on the job grade for this position. Individual compensation paid within this range will depend on many factors including geographic location, and we may ultimately pay more or less than the posted range. This range may be modified in the future.\n\nWe offer a comprehensive package of benefits including paid time off (vacation, holidays, sick), medical/dental/vision insurance and 401(k) to eligible employees.\n\nThis job is eligible to participate in our short-term incentive programs.\n\nNote: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable. The amount and availability of any bonus, commission, incentive, benefits, or any other form of compensation and benefits that are allocable to a particular employee remains in the Company's sole and absolute discretion unless and until paid and may be modified at the Company’s sole and absolute discretion, consistent with applicable law.\nAbbVie is an equal opportunity employer and is committed to operating with integrity, driving innovation, transforming lives and serving our community. Equal Opportunity Employer/Veterans/Disabled.\nUS & Puerto Rico only - to learn more, visit https://www.abbvie.com/join-us/equal-employment-opportunity-employer.html\nUS & Puerto Rico applicants seeking a reasonable accommodation, click here to learn more:\nhttps://www.abbvie.com/join-us/reasonable-accommodations.html","description_format":"text","description_chars":6552,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Oncology Therapeutics","Neurology & CNS Therapeutics"],"lifecycle":[{"event":"open","at":"2026-07-31T16:33:55Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 236 · green card filings: 57","filings_12m":236,"filings_prev_12m":256,"green_card_filings_12m":57,"median_offered_wage_usd":150555,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":11}],"liveness":{"score":7,"band":"cold","label":"Long shot","p_open":1,"p_active":0.235,"p_room":0.28,"age_days":89,"expected_fill_days":16,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-29T05:49:05Z"},"pay":{"stated_usd_annual":162000,"is_top_pay":false},"html_url":"https://alion.io/job/abbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2","json_url":"https://alion.io/job/abbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2.json","meta":{"generated_at":"2026-10-29T23:23:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":34400,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3660},"rest":"https://alion.io/mcp/rest/get_company?id=3660"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fabbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fabbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fabbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/abbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fabbvie-splunk-cribl-engineer-cybersecurity-engineering-hybrid-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":152841}},{"tool":"search_jobs","arguments":{"company":"abbvie.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":152841},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}