{"id":3955610,"url":"https://alion.io/job/unisys-splunk-performance-content-engineer","title":"Splunk Performance & Content Engineer","company":{"id":6839,"name":"Unisys","domain":"unisys.com","url":"https://alion.io/company/unisys","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":80,"ghost_share":0,"stale_share":0.863,"repost_share":0.013,"time_to_fill_p50_days":30,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Product","role_family":"Product","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Kanban","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OpenTelemetry","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-11-09T07:53:52Z","employer_posted_date":"2026-11-09","last_verified_at":"2026-11-09T07:53:52Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"What success looks like in this role:\nOptimize search performance: SPL tuning, data models and summary indexing across the 1,117 scheduled searches.\nTune Splunk and application settings for performance, scalability and reliability, in line with the RACI split with ACSC App/Dev.\nRemediate data-quality issues: parsing, sourcetype, index and volume problems.\nMonitor system health and search performance trends; report findings in the monthly service report.\nTune ITSI KPIs and episodes during ACSC business hours.\nWork down the backlog in the agreed priority order, and report weekly burn-down during transition.\nMaintain knowledge articles and runbooks for search and content work.\nAttend the daily stand-up (09:15 PT) and the biweekly planning and retrospective sessions; represent Shift B at ACSC ceremonies.\nReceive and hand over work in progress during the 05:00-06:00 PT warm handover.\n Content\nDesign and maintain dashboards, reports, alerts, correlation searches, and detection rules for security, IT operations, and application monitoring.\nDevelop and maintain CIM-compliant data models, field extractions, lookups, event types, and tags.\nPackage content into apps and manage it through version control and CI/CD (content lifecycle, testing, release).\nMap detections to frameworks such as MITRE ATT&CK, and reduce false positives through regular content tuning.\nWork with SOC, SRE, and application teams to gather requirements and turn them into actionable content.\n Performance\nAnalyze and optimize SPL, including slow searches, expensive dashboards, and inefficient scheduled searches.\nTune data model acceleration, summary indexing, report acceleration, and search scheduling to reduce load.\nMonitor platform performance with the Monitoring Console and internal logs (search concurrency, skipped searches, indexing latency, queue blocking, resource usage).\nOptimize ingestion through sourcetype and props/transforms tuning, event filtering, and index design.\nEstablish search and content standards, review peer content, and educate users on efficient SPL.\nReport on content quality, search performance, and license/storage trends, and recommend capacity improvements.\nYou will be successful in this role if you have:\nBA/BS degree and 8+ years’ relevant experience OR equivalent combination of education and experience.\nOver 7 years of experience on Advanced SPL, including data models, accelerated searches and summary indexing.\nSearch and scheduler performance analysis: skew, concurrency, search quotas and resource use.\nData onboarding and normalization: props, transforms, CIM mapping.\nExperience tuning ITSI services, KPIs and episodes.\nAbility to work with application and dashboard owners without owning dashboard design (ACSC App/Dev remains responsible).\nClear written and spoken English; comfortable overlapping the ACSC working day (Pacific Time).\nPreferred\nSplunk Certified Power User, Admin or Architect.\nSplunk Observability Cloud and OpenTelemetry exposure.\nScripting for automation (Python or Bash).\nExperience working a backlog in a Kanban or sprint model.\n Experience with Splunk Enterprise Security, ITSI, or Observability Cloud.\nKnowledge of detection engineering practices and MITRE ATT&CK.\nExperience with Dashboard Studio, REST APIs, and the Splunk SDK.\nUnisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.\nLocal employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.\nIf you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at . US job seekers can find more information about Unisys’ EEO commitment here.","description_format":"text","description_chars":4391,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Infrastructure & Networking Services","IT Help Desk & Service Desk","IT Consulting & Digital Transformation","Systems Integrators"],"lifecycle":[{"event":"open","at":"2026-11-09T07:53:52Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["conf:1","win:early","comp:brand"],"computed_at":"2026-11-09T09:10:26Z"},"pay":null,"html_url":"https://alion.io/job/unisys-splunk-performance-content-engineer","json_url":"https://alion.io/job/unisys-splunk-performance-content-engineer.json","meta":{"generated_at":"2026-11-09T09:10:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8391,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6839},"rest":"https://alion.io/mcp/rest/get_company?id=6839"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Funisys-splunk-performance-content-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Funisys-splunk-performance-content-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Funisys-splunk-performance-content-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/unisys-splunk-performance-content-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Funisys-splunk-performance-content-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3955610}},{"tool":"search_jobs","arguments":{"company":"unisys.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3955610},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}