{"id":4229292,"url":"https://alion.io/job/amentum-systems-administrator-splunk-sme","title":"Systems Administrator - Splunk SME","company":{"id":14861,"name":"Amentum","domain":"amentum.com","url":"https://alion.io/company/amentum","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":82,"open_postings":465,"ghost_share":0,"stale_share":0.912,"repost_share":0.002,"time_to_fill_p50_days":18,"computed_at":"2026-11-12T10:38:37Z"}},"role":"DevOps","role_family":"DevOps","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Fort Meade, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Ansible","optional":false},{"name":"Bash","optional":false},{"name":"CentOS Stream","optional":false},{"name":"Configuration Management","optional":false},{"name":"DNS","optional":false},{"name":"LDAP","optional":false},{"name":"Linux","optional":false},{"name":"PKI","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows Server","optional":false},{"name":"CI/CD","optional":true},{"name":"Git","optional":true}],"status":"live","first_seen_at":"2026-11-12T00:00:00Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-13T09:05:32Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Are you interested in using your skills to help shape the Cyber, Security, & Intel space? If so, look no further. Amentum is seeking a Systems Administrator - Splunk SME to join our team of passionate individuals at Fort Meade, MD. In this role you will support challenging, mission-critical projects that make a direct impact on the Nation’s security and intelligence mission.\nIn support of DISA, Amentum’s Intel and Cyber Division is expanding a proven team of highly skilled engineers and architects to support a program that provides critical IT capabilities to the Department of Defense. This team is committed to engineering, assembling, integrating, deploying, and sustaining an innovative IT enterprise solution.\nOur team delivers secure, mission-critical capabilities where system integrity and rapid deployment are paramount. We are seeking a Systems Administrator - Splunk SME who combines meticulous technical discipline with strategic foresight. In this role, you will lead efforts to establish and maintain robust baselines in a rapidly evolving operational environment. Success requires the ability to navigate complex, unique technical challenges independently while fostering collaborative solutions across integrated teams. To excel, you must possess a proactive learning mindset and the agility to rapidly master and govern the integration of next-generation systems and services.\nWork Schedule: 8 Hours per day, Monday thru Friday\nEssential Responsibilities: The duties and responsibilities of the Systems Administrator - Splunk SME include but are not limited to the following:\nThe Senior Splunk Administrator is responsible for the design, deployment, operation, and sustainment of enterprise Splunk platforms supporting log management, security monitoring, mission systems health, and operational analytics across classified networks. This role serves as the technical authority for the Splunk environment, ensuring availability, data integrity, performance, and compliance with Intelligence Community (IC) security policy. The incumbent works closely with cybersecurity analysts, system owners, network engineers, and mission customers to deliver trusted, actionable data in support of the organization's mission.\nKey Responsibilities:\nInstall, configure, upgrade, patch, and maintain Splunk Enterprise and Enterprise Security (ES) components, including indexers, search heads, heavy and universal forwarders, deployment servers, cluster managers, license managers, and monitoring consoles. \nAdminister indexer clustering and search head clustering to meet availability, retention, and disaster recovery requirements. \nPlan capacity, storage tiering, and data retention (hot/warm/cold/frozen) based on ingest volumes, search workloads, and mission needs. \nTune platform performance, including search optimization, data model acceleration, and resource allocation. \nOperate in air-gapped and cross-domain environments, including offline software and content transfers via approved procedures. \nDevelop and manage data ingestion pipelines from diverse sources (network devices, operating systems, applications, security tools, cloud services, and custom mission systems). \nCreate and maintain props, transforms, field extractions, source types, and Common Information Model (CIM) mappings to normalize data. \nManage data quality, forwarder health, and ingest anomalies; troubleshoot gaps and latency. \nImplement role-based access controls, index-level segregation, and need-to-know data compartmentation. \nEnsure the Splunk environment complies with applicable IC and DoD standards, such as ICD 503, NIST SP 800-53, RMF, and DISA STIGs. \nSupport system authorization activities by producing and maintaining security documentation, configuration baselines, and evidence artifacts. \nConfigure audit logging, authentication (e.g., PKI/CAC, SAML, LDAP/AD integration), and encryption of data in transit and at rest. \nRemediate vulnerabilities and implement findings from scans, inspections, and audits within required timelines. \nBuild and maintain dashboards, reports, alerts, correlation searches, and Splunk apps/add-ons to support SOC, insider threat, system health, and mission analytics use cases. \nPartner with analysts to translate operational requirements into SPL searches and detection logic. \nSupport incident response by providing rapid search, data retrieval, and forensic timeline support. \nAutomate administration and deployment tasks using scripting and configuration management (e.g., Python, Bash, PowerShell, Ansible). \nMaintain operational runbooks, SOPs, architecture diagrams, and change management records. \nProvide Tier 3 escalation support and mentor junior administrators and analysts. \nParticipate in change control boards, technical working groups, and design reviews; brief leadership on platform status, risks, and roadmap. \nEvaluate emerging Splunk capabilities and recommend improvements to the enterprise logging and analytics strategy. \nDemonstrated expertise in indexer and search head clustering, forwarder management, and distributed Splunk architectures. \nStrong proficiency in Search Processing Language (SPL), regular expressions, and data parsing/normalization. \nExperience working on classified or air-gapped networks. \nSolid Linux system administration skills (RHEL/CentOS preferred); working knowledge of Windows Server. \nWorking knowledge of networking fundamentals (TCP/IP, syslog, DNS, TLS) and security concepts. \nCompliance with DoD 8140 / IC workforce certification requirements, such as Security+ CE or equivalent for the assigned work role, obtained within the required timeframe. \nPrior experience in an IC, DoD, or other government cyber environment. \nExpert-level knowledge of Splunk architecture, data lifecycle, and performance tuning. \nAbility to analyze complex technical problems and deliver reliable solutions under mission-driven timelines. \nStrong written and verbal communication skills, including the ability to explain technical concepts to non-technical leaders. \nSound judgment in handling classified information and adherence to security protocols. \nAbility to work independently and collaboratively in a multi-disciplinary team environment. \nCommitment to documentation, process discipline, and continuous improvement. \nMentor junior engineers and share technical knowledge across the team \nWork Environment, Physical Demands, and Mental Demands:\nEmployee will work in a SCIF on a daily basis.\nEmployee may also be required to work in a datacenter environment for specified periods of time.\nSecurity Clearance Required: Must have active Top Secret clearance with SCI eligibility\n Minimum Education: Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field, or equivalent experience (additional years of relevant experience may substitute for education) or equivalent professional experience (typically 4 additional years in lieu of degree). \nMinimum Years of Experience:\nExperience: [8+] years of progressive IT experience, including [5+] years administering Splunk Enterprise in a large-scale production environment.\nExperience working in accredited, access-controlled, or air-gapped environments\nRequired Certifications: (One or more of the following)\nSplunk Enterprise Certified Architect \nDoD 8570.01-M IAT-II baseline certification requirements\nPreferred Qualifications:\nSplunk Core Certified Consultant\nExperience with Splunk Enterprise Security, SOAR, or ITSI. \nExperience supporting SOC, cyber threat hunting, or insider threat programs. \nundefined\nExperience with configuration management and automation tools (Ansible, Git, CI/CD pipelines). \nThis position is designated as a safety sensitive position.\nAs part of our commitment to maintaining a safe and compliant work environment, Amentum is a drug-free workplace and requires all personnel to comply with company drug and alcohol policies as a condition of employment. Employment is contingent upon successful completion of the drug screening process. Please note that this may include pre-hire screening for marijuana, as well as other federally controlled substances due to Amentum’s role as a federal contractor and trusted partner to the US Government.\nOther Responsibilities:\nSafety - Amentum enforces a safety culture whereby all employees have the responsibility for continuously developing and maintaining a safe work environment. As appropriate, each employee is responsible for completing all training requirements and fulfilling all self-aid/buddy aid responsibilities, participating in emergency response tasks and serving on safety committees and teams.\nQuality - Quality is the foundation for the management of our business and the keystone to our goal of customer satisfaction. It is our policy to consistently provide services that meet customer expectations. Accordingly, each employee must conform to the Amentum Quality Policy and carry out job activities in compliance with applicable Amentum Quality System documents and customer contracts. Each employee must read and understand his/her Quality Management and Customer Satisfaction responsibilities.\nProcedure Compliance - Each employee must read, understand and implement the general and specific operational, safety, quality and environmental requirements of all plans, procedures and policies pertaining to his/her job. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability or protected veteran status.\nCompensation Details:\n$180k - $225kThe compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws.\nBenefits Overview:\nOur health and welfare benefits are designed to support you and your priorities. Offerings include:\nHealth, dental, and vision insurance\n\nPaid time off and holidays\n\nRetirement benefits (including 401(k) matching)\n\nEducational reimbursement\n\nParental leave\n\nEmployee stock purchase plan\n\nTax-saving options\n\nDisability and life insurance\n\nPet insurance\n\nNote: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara-O'Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits.\nOriginal Posting:\n11/12/2026 - Until FilledAmentum anticipates this job requisition will remain open for at least three days, with a closing date no earlier than three days after the original posting. This timeline may change based on business needs.\nAmentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race, sex, sexual orientation, pregnancy (including pregnancy, childbirth, breastfeeding, or medical conditions related to pregnancy, childbirth, or breastfeeding), age, ancestry, United States military or veteran status, color, religion, creed, marital or domestic partner status, medical condition, genetic information, national origin, citizenship status, low-income status, or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation, or any other protected category under federal, state, or local law. Learn more about your rights under Federal laws and supplemental language at Labor Laws Posters.","description_format":"text","description_chars":11720,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity","Life insurance","Parental leave","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Military Logistics","Facilities Management","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-11-13T09:05:32Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 4","filings_12m":4,"filings_prev_12m":5,"green_card_filings_12m":0,"median_offered_wage_usd":107500,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":18,"reasons":["conf:3","win:early","comp:brand"],"computed_at":"2026-11-13T12:33:58Z"},"pay":null,"html_url":"https://alion.io/job/amentum-systems-administrator-splunk-sme","json_url":"https://alion.io/job/amentum-systems-administrator-splunk-sme.json","meta":{"generated_at":"2026-11-13T12:33:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25239,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14861},"rest":"https://alion.io/mcp/rest/get_company?id=14861"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Famentum-systems-administrator-splunk-sme"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Famentum-systems-administrator-splunk-sme"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Famentum-systems-administrator-splunk-sme"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/amentum-systems-administrator-splunk-sme\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Famentum-systems-administrator-splunk-sme"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4229292}},{"tool":"search_jobs","arguments":{"company":"amentum.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4229292},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}