Splunk Performance & Content Engineer

What success looks like in this role:

• Optimize search performance: SPL tuning, data models and summary indexing across the 1,117 scheduled searches.
• Tune Splunk and application settings for performance, scalability and reliability, in line with the RACI split with ACSC App/Dev.
• Remediate data-quality issues: parsing, sourcetype, index and volume problems.
• Monitor system health and search performance trends; report findings in the monthly service report.
• Tune ITSI KPIs and episodes during ACSC business hours.
• Work down the backlog in the agreed priority order, and report weekly burn-down during transition.
• Maintain knowledge articles and runbooks for search and content work.
• Attend the daily stand-up (09:15 PT) and the biweekly planning and retrospective sessions; represent Shift B at ACSC ceremonies.
• Receive and hand over work in progress during the 05:00-06:00 PT warm handover.
• Content
• Design and maintain dashboards, reports, alerts, correlation searches, and detection rules for security, IT operations, and application monitoring.
• Develop and maintain CIM-compliant data models, field extractions, lookups, event types, and tags.
• Package content into apps and manage it through version control and CI/CD (content lifecycle, testing, release).
• Map detections to frameworks such as MITRE ATT&CK, and reduce false positives through regular content tuning.
• Work with SOC, SRE, and application teams to gather requirements and turn them into actionable content.
• Performance
• Analyze and optimize SPL, including slow searches, expensive dashboards, and inefficient scheduled searches.
• Tune data model acceleration, summary indexing, report acceleration, and search scheduling to reduce load.
• Monitor platform performance with the Monitoring Console and internal logs (search concurrency, skipped searches, indexing latency, queue blocking, resource usage).
• Optimize ingestion through sourcetype and props/transforms tuning, event filtering, and index design.
• Establish search and content standards, review peer content, and educate users on efficient SPL.
• Report on content quality, search performance, and license/storage trends, and recommend capacity improvements.

You will be successful in this role if you have:

BA/BS degree and 8+ years’ relevant experience OR equivalent combination of education and experience.

Over 7 years of experience on Advanced SPL, including data models, accelerated searches and summary indexing.

• Search and scheduler performance analysis: skew, concurrency, search quotas and resource use.
• Data onboarding and normalization: props, transforms, CIM mapping.
• Experience tuning ITSI services, KPIs and episodes.
• Ability to work with application and dashboard owners without owning dashboard design (ACSC App/Dev remains responsible).
• Clear written and spoken English; comfortable overlapping the ACSC working day (Pacific Time).

Preferred

• Splunk Certified Power User, Admin or Architect.
• Splunk Observability Cloud and OpenTelemetry exposure.
• Scripting for automation (Python or Bash).
• Experience working a backlog in a Kanban or sprint model.
• Experience with Splunk Enterprise Security, ITSI, or Observability Cloud.
• Knowledge of detection engineering practices and MITRE ATT&CK.
• Experience with Dashboard Studio, REST APIs, and the Splunk SDK.

Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.

Local employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.

If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [email protected]. US job seekers can find more information about Unisys’ EEO commitment here.