{"id":3036314,"url":"https://alion.io/job/pueo-data-intake-integrations-di-analyst-mid-splunk","title":"Data Intake & Integrations (D&I) Analyst- Mid (Splunk)","company":{"id":2598495,"name":"Pueo","domain":"pueo.com","url":"https://alion.io/company/pueo","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Paylocity","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Administrative","role_family":"Administrative","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["McLean, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":102000,"max":142425,"currency":"USD","period":"year","gross":null,"usd_annual":142425},"salary_estimate":null,"experience_years_min":11,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Bash","optional":false},{"name":"FedRAMP","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-21T18:03:59Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-22T02:10:37Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Description\nPueo is seeking a Data Intake & Integrations (D&I) Analyst-Mid (Splunk) Analyst to join our unique team of multidisciplined experts onsite in McLean, VA.\nTeam Description:\nThe DI&I team is the gateway for all log and data sources entering TESIEMS, ensuring ingested data is normalized, structured, and tagged for maximum utility. The team measures deviations in log formats, enables data segregation by Treasury component and FISMA boundary, and leads the data framework that monitors key data metrics and identifies coverage or quality gaps. DI&I coordinates with federal stakeholders, bureau security teams, and third-party vendors to onboard and standardize data feeds; leads rapid response when data pipelines are disrupted; supports SOC consolidation and multitenancy (alerts, notifications, content sharing, and access across bureaus); manages orchestration tasks such as audit-logging pipelines and ticketing automation; and integrates with asset management, compliance, and threat intelligence systems via APIs, connectors, and pipelines.\nRoles and Responsibilities:\nProvide operational and engineering support for the Department of the Treasury’s enterprise Splunk environment under the Treasury Enterprise SIEM (TESIEMS) program. The role administers Splunk, onboards new data sources, ensures data quality and normalization, and maintains continuous visibility across enterprise systems, enabling Treasury SOC teams to detect, analyze, and respond to cybersecurity threats and to meet compliance reporting requirements. More specifically:\nPerform day-to-day Splunk administration, including monitoring system health, managing indexes, and troubleshooting ingestion and search performance issues.\nSupport Splunk operations in hybrid environments (on-premises servers, AWS compute/storage, Linux VMs).\nApply patches, upgrades, and configurations to maintain the stability and compliance of Splunk infrastructure.\nOnboard new data sources into Splunk using syslog, HTTP Event Collector (HEC), JSON feeds, and APIs.\nNormalize and validate ingested data to align with the Splunk Common Information Model (CIM) and SOC use cases.\nCollaborate with system owners, engineers, and SOC analysts to configure log forwarding and resolve onboarding issues.\nDevelop and maintain ingestion pipelines that support large-scale Treasury SOC operations.\nTune parsing, field extractions, and source types for optimal indexing and search performance.\nDocument and maintain data onboarding procedures, schemas, and configuration standards.\nEnsure Splunk onboarding and data retention configurations align with Treasury security and compliance requirements (NIST RMF and FISMA).\nGenerate audit-ready intake documentation and data validation reports for compliance reviews.\nWork with compliance and CD&M teams to ensure Splunk data supports continuous monitoring and reporting mandates.\nProvide Tier II/III Splunk intake and administration support, escalating complex issues to senior Splunk engineers as required.\nPartner with SOC analysts and content engineers to ensure onboarded data supports detection, dashboards, and reporting needs.\nContribute to DI&I process-improvement initiatives that streamline intake and optimize operational workflows\nRequirements\nKnowledge:\nCybersecurity principles and practices, with broad understanding of related cybersecurity specialty areas.\nSplunk Enterprise architecture and the Splunk Common Information Model (CIM).\nHybrid infrastructure: on-premises servers, AWS compute/storage, virtual machines, and Linux environments.\nIncident detection, incident response, and security event management.\nNIST SP 800-53, NIST RMF, FISMA, FedRAMP, and DISA STIGs, and their application in SOC environments.\nSkills:\nSplunk Enterprise administration (indexes, user management, system performance).\nSplunk data onboarding using syslog, HEC, JSON, APIs, and other ingestion methods.\nNormalizing log data to Splunk CIM standards; tuning parsing, field extractions, and source types.\nScripting and automation in Python, Bash, or PowerShell for ingestion testing and log data analysis.\nUse of security tools such as SIEMs (e.g., Splunk), IDS/IPS, and endpoint detection.\nStrong technical documentation and communication skills.\nAbilities:\nThe ability to solve complex and unclear technical problems.\nThe ability to develop and implement technical solutions independently.\nThe ability to validate, troubleshoot, and normalize log data for operational and compliance use.\nThe ability to assess the impact of changes on end-products or solutions.\nThe ability to apply strong analytical and critical-thinking skills.\nThe ability to collaborate with SOC teams, content engineers, internal cybersecurity experts, and system stakeholders.\nRequired Qualifications:\nCertifications:\nRequired: Splunk Core Certified User.\nPreferred: At least one higher-level Splunk certification - Splunk Enterprise Certified Architect, Splunk Enterprise Security Certified Admin, Splunk SOAR Certified Automation Developer, Splunk Cloud Certified Admin, or Splunk IT Service Intelligence (ITSI) Certified Admin.\nDesirable: Relevant cybersecurity certifications such as CISSP, CISM, or CompTIA CySA+.\nEducation:\nBachelor’s Degree in Cybersecurity, Computer Science, Information Technology, or Related Field\n[As a substitution for a Bachelor’s degree-four (4) additional years of relevant experience (11 years total)\nOther:\nSeven (7) years of relevant experience.\nMust be a US Citizen.\nPrior SOC or Department of the Treasury experience preferred.\nClearance:\nActive Secret clearance required (interim Secret not accepted).\nMin $102,000 to $142,425\nThe estimate displayed represents the typical salary range for this position and is just one component of Pueo’s total compensation package for employees. Other rewards may include annual bonuses, short- and long-term incentives, and program-specific awards. In addition, Pueo provides a variety of benefits to employees.\nBENEFITS:\nAt Pueo, our benefits are designed to help keep you at your best beyond the work you do with us daily. We’re fully committed to the growth of our employees. From fully comprehensive medical plans to professional development resources, we are there to support you all the way.\nPUEO OVERVIEW:\nPueo is a National Security cyber company built to inspect, defend, harden, and continuously authorize the networks our customers depend on. We deliver mission-grade cybersecurity across defense, intelligence, homeland security, federal enterprise, and critical infrastructure. Our work connects mission-risk inspection, defensive cyber operations, continuous authorization, security engineering, and mission delivery through one accountable team.\nPUEO EEO STATEMENT:\nPueo is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. Pueo takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.","description_format":"text","description_chars":7257,"description_truncated":false,"requirements":{"experience_years_min":11,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Annual bonuses","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","National Security","Incident Response","Homeland Security"],"lifecycle":[{"event":"open","at":"2026-10-21T21:28:27Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":31,"reasons":["conf:3","win:early"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":142425,"is_top_pay":true},"html_url":"https://alion.io/job/pueo-data-intake-integrations-di-analyst-mid-splunk","json_url":"https://alion.io/job/pueo-data-intake-integrations-di-analyst-mid-splunk.json","meta":{"generated_at":"2026-10-22T09:56:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6918,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2598495},"rest":"https://alion.io/mcp/rest/get_company?id=2598495"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpueo-data-intake-integrations-di-analyst-mid-splunk"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpueo-data-intake-integrations-di-analyst-mid-splunk"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpueo-data-intake-integrations-di-analyst-mid-splunk"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/pueo-data-intake-integrations-di-analyst-mid-splunk\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpueo-data-intake-integrations-di-analyst-mid-splunk"}]}