Senior Splunk Engineer (m/f/d)

Job Title: Senior Splunk Engineer

Location: Riyadh

Job Summary:

The Senior Splunk Engineer will be responsible for the design, implementation, administration, and optimization of Splunk Enterprise or Splunk Cloud within a large-scale enterprise or managed services environment. The engineer will support log onboarding, correlation rule development, dashboard creation, and performance tuning, ensuring the Splunk platform delivers accurate, actionable insights for security operations and compliance monitoring.

Key Responsibilities:

• Design and implement end-to-end Splunk solutions including data ingestion, parsing, indexing, and search optimization.
• Develop and maintain custom correlation rules, alerts, dashboards, and visualizations to support security monitoring and incident response.
• Onboard new log sources from infrastructure, security, application, and cloud systems using best practices (e.g., via UF, HF, syslog, APIs).
• Perform regular health checks, indexer and search head performance tuning, license usage monitoring, and configuration backups.
• Support threat detection initiatives by translating security use cases into actionable Splunk queries and alerts.
• Assist in troubleshooting ingestion failures, parsing errors, and inefficient searches.
• Collaborate with SOC, threat intelligence, and infrastructure teams to ensure data relevance, completeness, and quality.
• Maintain Splunk Enterprise Security (ES) configurations, including CIM compliance, notables, and risk-based alerting (RBA).
• Implement and manage data retention policies and storage utilization in line with compliance requirements.
• Automate tasks and processes using scripts (Python, Bash, PowerShell) and configuration management tools where needed.
• Provide technical guidance and mentoring to junior Splunk engineers and analysts.
  
  

Required Skills & Experience:

• 5+ years of hands-on experience in SIEM engineering with at least 3 years focused on Splunk Enterprise or Splunk Cloud.
• Proficient in SPL (Search Processing Language), data onboarding, and CIM normalization.
• Experience integrating diverse log sources including firewalls, endpoints, cloud (AWS, Azure), identity systems, and threat intel feeds.
• Strong understanding of security operations, detection engineering, and incident response workflows.
• Familiarity with Splunk ES, UBA, ITSI, and SOAR (preferred but not mandatory).
• Experience with scripting and automation (Python, Bash, PowerShell).
• Good knowledge of networking, security protocols, and system administration (Windows/Linux).
• Exposure to regulatory and compliance requirements such as ISO 27001, NCA, SAMA, PCI-DSS, etc.
  
  

Preferred Certifications:

• Splunk Core Certified Power User – Required
• Splunk Enterprise Security Certified Admin – Preferred
• Splunk Certified Architect or Consultant – Highly Desirable
• CompTIA Security+, CISSP, or equivalent – Advantageous
  
  

Halian Group:

With over 28 years of experience, we have come to understand that innovation is the only way to provide agile, practical solutions that transform businesses and careers.

Our resourcing and smart services help you to realize tomorrow’s potential. Discover the amazing things possible when you bring the right people and the right technologies together.

At Halian, we recognize that diversity, equity, and inclusion (DEI) are essential to building high-performing teams for our clients. We are committed to connecting organizations with top talent from all backgrounds, ensuring that every individual feels valued, respected, and empowered to contribute their unique perspectives. We encourage applications from all qualified candidates, regardless of race, gender, disability, or any other characteristic that makes them unique. By fostering diverse and inclusive workplaces, we help our clients drive innovation, enhance collaboration, and better reflect the communities they serve.

Senior Splunk Engineer in Riyadh, Saudi Arabia