splunk consultant

RELYzIT

<div>
 
 Sr. Splunk ES Consultant (Freelance) - 3 months- Riyadh, Saudi Arabia
 
 
 At RELYzIT Talent, we don&rsquo;t recruit &mdash; we build. We unite the top 2% of builders &mdash; engineers, architects, creators &mdash; into a movement across Europe and the GCC. Vetted through our VECTOR7&trade; Signal Stack, you&rsquo;re not just hired, you&rsquo;re chosen. This is more than work. This is where builders build the future.
 
 
 About the Role
 
 
 We are seeking a hands-on, Riyadh-based Sr. Splunk Enterprise Security Consultant for a freelance engagement with our client. This is a high-impact role in a high-pressure, regulated environment where your expertise will directly shape security outcomes. You&rsquo;ll be the go-to builder for Splunk ES administration, driving mission-critical security operations and ensuring robust, audit-ready environments.
 
 
 Why This Role Matters
 
 
 Our client operates in a landscape where security, compliance, and real-time insights are non-negotiable. As a Splunk ES Consultant, you will be instrumental in architecting, optimizing, and troubleshooting the backbone of their security intelligence. Your work will empower teams to detect threats faster, respond smarter, and maintain the highest standards of compliance &mdash; making a tangible impact on business resilience and trust.
 
 
 What You&rsquo;ll Be Doing
 
 <ul>
 <li>
 Administer and optimize Splunk Enterprise Security (ES) environments, including Indexers, Search Heads, and clustering.
 </li>
 <li>
 Deploy and manage Universal Forwarders (UF) and Heavy Forwarders (HF) for seamless data ingestion.
 </li>
 <li>
 Lead end-to-end data onboarding from diverse sources: Windows, Linux, network devices, cloud platforms, and APIs.
 </li>
 <li>
 Configure and fine-tune props.conf and transforms.conf for data normalization and enrichment.
 </li>
 <li>
 Implement and maintain CIM normalization to ensure consistent, actionable data models.
 </li>
 <li>
 Design, build, and optimize SPL queries, alerts, dashboards, and correlation rules for proactive threat detection.
 </li>
 <li>
 Troubleshoot ingestion delays, license issues, and search performance bottlenecks with precision and urgency.
 </li>
 <li>
 Integrate Splunk ES with critical security infrastructure: firewalls, proxies, EDR, Active Directory, and more.
 </li>
 <li>
 Collaborate with security and compliance teams to ensure audit readiness and evidence management.
 </li>
 </ul>
 
 Technical Skills &amp; Experience
 
 <ul>
 <li>
 Proven hands-on experience in Splunk ES administration (not just analysis).
 </li>
 <li>
 Deep knowledge of Indexers, Search Heads, clustering, and distributed Splunk architectures.
 </li>
 <li>
 Expertise in deploying and managing UF/HF, and onboarding data from multiple environments.
 </li>
 <li>
 Strong command of SPL, dashboard creation, alerting, and correlation rule development.
 </li>
 <li>
 Advanced troubleshooting skills for ingestion, licensing, and performance issues.
 </li>
 <li>
 Experience with CIM normalization and configuration of props.conf/transforms.conf.
 </li>
 <li>
 Integration experience with firewalls, proxies, EDR, and Active Directory.
 </li>
 <li>
 Bonus: Experience with Splunk ES use cases, incident triage, and UBA exposure.
 </li>
 <li>
 Bonus: Background in audit-ready, compliance-driven environments and ITIL awareness.
 </li>
 </ul>
 
 Mindset &amp; Approach
 
 <ul>
 <li>
 Builder mentality: You own outcomes, not just tasks.
 </li>
 <li>
 Problem-solver: You thrive in high-pressure, regulated environments and deliver under tight deadlines.
 </li>
 <li>
 Compliance-driven: You understand the importance of evidence, audit trails, and regulatory standards.
 </li>
 <li>
 Ready to hit the ground running &mdash; this is not a learning role.
 </li>
 </ul>
 
 Language Proficiency
 
 <ul>
 <li>
 Fluent English required (spoken and written).
 </li>
 </ul>
 
 Other Requirements
 
 <ul>
 <li>
 Based in Riyadh, Saudi Arabia.
 </li>
 <li>
 Freelance position with immediate start and project-based duration.
 </li>
 <li>
 Experience in regulated, audit-ready environments preferred.
 </li>
 <li>
 Awareness of ITIL or similar frameworks is a plus.
 </li>
 </ul>
 
 
 
 
 
 
 
 
 Ready to build the future with us? Upload your CV and join the movement of elite builders at RELYzIT Talent
 
 
 
 
 
 
 .
 
 
 #RELYzIT #TechJobs #FreelanceTalent #Riyadh #Splunk #SplunkES #SecurityEngineering #SIEM #CyberSecurity #VECTO
 
 
 
 
 
 R7
 
</div>

Senior Splunk ES Consultant

Al Adyat consultancy

Role OverviewOwns end-to-end delivery of the Splunk Phantom (SOAR) platform, covering architecture, design, playbook development, integrations, automation, tuning, and structured handover into security operations.Key Responsibilities&middot; Lead solution architecture and detailed design (HLD / LLD) for Splunk SOAR&middot; Build, configure, and maintain the Splunk SOAR platform and core components&middot; Design, develop, and optimize automation playbooks for security incident response&middot; Integrate SOAR with SIEM, EDR, IAM, threat intelligence, and enterprise tooling&middot; Implement orchestration workflows aligned to SOC processes and use cases&middot; Test, validate, and tune playbooks to ensure reliability and operational effectiveness&middot; Troubleshoot platform, integration, and automation issues&middot; Produce operational documentation and conduct knowledge transfer to run teams&middot; Support stabilization and transition into BAU operationsSkills and Experience&middot; Strong hands-on experience with Splunk SOAR (Phantom)&middot; Proven experience in SOAR architecture, automation, and playbook development&middot; Strong understanding of SOC operations and incident response workflows&middot; Experience integrating SOAR with SIEM, EDR, ticketing, and threat intelligence platforms&middot; Experience producing technical design and operational handover documentationKey Deliverables&middot; SOAR solution architecture and design documentation&middot; Configured and integrated Splunk SOAR platform&middot; Implemented and validated automation playbooks&middot; Runbooks, SOPs, and formal handover to operationsPay: QAR12,000.00 - QAR14,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>Splunk SOAR (Phantom): 3 years (Required)</li><li>integrating SOAR with SIEM, EDR, ticketing: 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in computer science (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>Work Location: In person

SOAR Specialist (Splunk)

Role OverviewOwns end-to-end delivery of the Splunk Enterprise (SIEM) platform, covering architecture, design, onboarding, configuration, tuning, use case implementation, and structured handover into operations.Key Responsibilities&middot; Lead solution architecture and detailed design (HLD / LLD) for Splunk SIEM&middot; Build, configure, and manage Splunk platform components including indexers, search heads, forwarders, and apps&middot; Onboard log sources and data feeds in line with security logging standards&middot; Develop, tune, and optimize correlation searches, alerts, and detections&middot; Implement threat-based and use-case-driven monitoring aligned to MITRE ATT&amp;CK&middot; Validate data quality, parsing, normalization, and field extractions&middot; Integrate Splunk with upstream and downstream tools including EDR, SOAR, ticketing, and threat intelligence&middot; Produce operational documentation and conduct knowledge transfer to run teams&middot; Support stabilization and transition into BAU operationsSkills and Experience&middot; Strong hands-on experience with Splunk Enterprise SIEM&middot; Proven experience in SIEM architecture, engineering, log onboarding, and use-case development&middot; Strong understanding of security logging, detection engineering, and incident response&middot; Experience integrating SIEM with EDR, SOAR, and enterprise security tooling&middot; Experience producing technical design and operational handover documentationKey Deliverables&middot; SIEM solution architecture and design documentation&middot; Configured and optimized Splunk SIEM platform&middot; Implemented and tuned detection and monitoring use casesRunbooks, SOPs, and formal handover to operationsPay: QAR12,000.00 - QAR14,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>Splunk Enterprise (SIEM) platform: 3 years (Required)</li><li>EDR, SOAR, and enterprise security tooling: 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in computer science (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>Work Location: In person

SIEM Specialist (Splunk)

DeepSource Technologies

<div><ul><li>Design, implement, and manage complex Splunk environments to ensure high availability and performance.</li>
<li>Develop and deploy Splunk applications, dashboards, and reports for monitoring and analysis.</li>
<li>Perform data ingestion from various sources and ensure data accuracy and integrity.</li>
<li>Troubleshoot and resolve technical issues related to Splunk instances and forwarders.</li>
<li>Optimize Splunk searches, queries, and performance using best practices.</li>
<li>Work closely with security, operations, and development teams to integrate Splunk into existing workflows.</li>
<li>Conduct training and provide support to team members and end-users on Splunk capabilities.</li>
<li>Stay updated with the latest Splunk features, best practices, and industry trends.</li> 
</ul> 
 
Requirements 
<ul>
<li>Proven experience as a Senior Splunk Engineer with 5+ years of hands-on experience in deploying and managing Splunk environments.</li>
<li>Strong knowledge of Splunk architecture, administration, and data ingestion methodologies.</li>
<li>Experience in creating Splunk dashboards, reports, and alerts.</li>
<li>Familiarity with scripting languages (e.g., Python, PowerShell) for automation and customization.</li>
<li>Excellent troubleshooting skills and ability to work under pressure.</li>
<li>Strong analytical and problem-solving abilities.</li>
<li>Experience working in a collaborative team environment.</li>
<li>Certification as a Splunk Certified Admin or Splunk Certified Architect is a plus.</li> 
</ul> 
 
Benefits 
o Medical insurance including family.
o Flight tickets including family.</div>

Senior Cybersecurity Engineer - Splunk - Riyadh, KSA

Role OverviewOwns end-to-end delivery of threat intelligence onboarding and integration using Anomali, including architecture, data ingestion, enrichment, correlation, and integration with Splunk SIEM and Splunk SOAR to enhance detection, investigation, and automated response capabilities.Key Responsibilities&middot; Lead solution architecture and detailed design (HLD / LLD) for threat intelligence integration&middot; Deploy, configure, and optimize Anomali Threat Intelligence Platform&middot; Onboard threat intelligence feeds and manage lifecycle, scoring, and confidence tuning&middot; Integrate Anomali with Splunk SIEM for enrichment, correlation, and detection enhancement&middot; Integrate threat intelligence into Splunk SOAR playbooks for automated response&middot; Implement use cases aligned to SOC investigation and threat hunting workflows&middot; Validate data quality, mappings, and enrichment effectiveness&middot; Troubleshoot integration, data, and performance issues&middot; Produce operational documentation and conduct knowledge transfer to run teams&middot; Support stabilization and transition into BAU operationsSkills and Experience&middot; Strong hands-on experience with Anomali Threat Intelligence Platform&middot; Experience integrating threat intelligence with Splunk SIEM and Splunk SOAR&middot; Strong understanding of threat intelligence lifecycle, IOC management, and enrichment&middot; Knowledge of SOC operations, threat detection, and incident response&middot; Experience producing technical design and operational handover documentationKey Deliverables&middot; Threat intelligence architecture and integration design documentation&middot; Configured Anomali TIP integrated with Splunk SIEM and SOAR&middot; Enrichment and correlation use cases implemented&middot; Runbooks, SOPs, and formal handover to operationsPay: QAR12,000.00 - QAR14,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>Anomali Threat Intelligence Platform: 3 years (Required)</li><li>Splunk SIEM and Splunk SOAR: 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in computer science (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>Work Location: In person

Threat Intelligence Specialist (Anomali / Splunk)

Openkyber

<div>Greetings from OpenKyber! We reaching out about an exciting Direct client opportunity with one of our clients. Please review the requirements and let me know if you are interested in this position? Direct client Req:: Need Sr Application Security Architect &amp; Engineer Hybrid , VA PLEASE SEND THE RESUMES TO hirings@openkyber.com ! Job Description: Description: ABOUT THE ROLE Virginia Tax is seeking an Application Security Engineer (ASE) with 5+ years of experience to join the Office of Technology under Joint Security Operations. In this role, the ASE serves as a dedicated security partner to application teams, providing guidance on secure design, vulnerability management, and secure development practices. The ASE works collaboratively across the SDLC to ensure security is embedded into application design, development, testing, and deployment. This includes supporting compliance requirements, delivering training and education, and assisting teams with vulnerability remediation efforts. The successful candidate will identify and recommend improvements to improve the security of all Virginia Tax applications, promote secure coding and development practices, and contribute to ongoing initiatives that reduce risk and strengthen the agency s overall security posture. Responsibilities include but not limited to: Provide security guidance, training, and best practices for development and operations teams. Support secure software development by applying knowledge of SDLC, Agile, and Scrum methodologies. Evaluate software architecture and design for security risks and alignment with DevSecOps principles. Promote and enforce secure coding standards and guidelines. Review source code to identify vulnerabilities and recommend remediation strategies. Assess security risks across multiple programming languages (e.g., JavaScript, C#, Java, Ruby, SQL). Analyze and secure modern web application architectures, including cloud, APIs, microservices, and client server models. Identify and address common vulnerabilities, including those outlined in the OWASP Top 10. Support vulnerability remediation, patch management, and continuous improvement efforts. Utilize application security testing tools such as SAST, DAST, IAST, and platforms like Accunetix, Veracode, Jenkins, Splunk, Rapid7, and Tenable. Interpret and act on findings from SIEM systems, including Splunk. Apply knowledge of common security controls and frameworks. Ensure compliance with relevant security regulations and standards (e.g., NIST 80053, IRS Pub 1075, PCIDSS). Implement and evaluate AWS cloud security controls and best practices. Create, maintain, and review System Security Plans (SSPs). Troubleshoot and resolve complex technical and security-related issues. Stay current with evolving threats, technologies, and industry trends. Develop detailed plans and communicate risks, impacts, and recommendations effectively. Collaborate with application teams, QA engineers, and operations teams to integrate security into workflows. Provide constructive, actionable feedback to application teams. Communicate technical concepts clearly to both technical and nontechnical audiences. Work closely with other security analysts and technology teams to support agency and enterprise security initiatives. Manage multiple tasks, prioritize effectively, and meet deadlines. Apply critical thinking to evaluate and mitigate security risks and vulnerabilities. Required Skills/Experience: Five or more years experience in application security. Two or more years network or firewall/AWS Security Groups. Experience with log collection, vulnerability scans and remediation, or privileged access management. Strong understanding of security concepts, network protocols, and threat vectors. Proficiency in SIEM,IDS/IPS, EDR,and other relevant security tools. Excellent analytical and problem-solving skills. Strong communication, collaboration, and documentation skills. Ability to work independently and as part of a team in a fast-paced environment. Have experience and a strong knowledge of the following: Splunk, InsightVM Rapid7, Tenable, CyberArk, Jenkins, Veracode Linux and Windows Operating Systems, Baseline hardening of operating systems IIS and Apache, Scripting Languages and SQL, PowerShell, Firewall At least one of these certs below is REQUIRED: CompTIA Security+ ISC2 CC (Certified in Cybersecurity) Offensive Security Certified Professional (OSCP) CCSP (Certified Cloud Security Professional) CSSLP (Certified Secure Software Lifecycle Professional) At least one of these certs below is highly DESIRED (Independently and or with one of the above) AWS Solutions Architect (Associate/Professional) AWS Security Specialty At least one of the any is DESIRED CompTIA PenTest+ Certified Ethical Hacker (CEH), GIAC Certified Intrusion Analyst (GCIA Fill the above skills in the below box and have consultant to complete SKILLS MATRIX Skill Required Amount of Experience Experience Application Security Required 5 Years Network or Firewall/AWS security Groups Required 2 Years Infrastructure as Code (IaC): Advanced proficiency in Terraform for multi-account landing zones and automated provisioning. Required 2 Years Experience with log collection, vulnerability scans and remediation, or privileged access management Required 4 Years Proficiency in SIEM, IDS/IPS, EDR, and other relevant security tools. Required 4 Years Networking &amp; Hybrid Connectivity: Solid understanding of routing, firewalls, AWS Direct Connect, and VPNs in a hybrid cloud environment. Required 4 Years One REQUIRED: CompTIA Security+, ISC2 CC (Certified in Cybersecurity), Offensive Security Certified Professional (OSCP), CCSP, or CCLP. UPLOAD COPY!! Required CI/CD &amp; DevOps: Experience with GitLab CI/CD, Jenkins, or AWS CodePipeline for automated, secure deployments. Highly desired 5 Years Splunk, InsightVM Rapid7, Tenable, CyberArk, Jenkins, Veracode Highly desired 2 Years Linux and Windows Operating Systems, Baseline hardening of operating systems Highly desired 2 Years IIS and Apache, Scripting Languages and SQL, PowerShell, Firewall Highly desired 2 Years One highly DESIRED (Independently and or with one of the above): AWS Solutions Architect (Associate/Professional) or AWS Security Specialty Highly desired One of these is DESIRED: CompTIA PenTest+, Certified Ethical Hacker (CEH), or GIAC Certified Intrusion Analyst (GCIA) Highly desired OpenKyber Austin, TX 78727| Direct: OpenKyber is an Affirmative Action/Equal Opportunity Employer that supports workplace diversity. All employment decisions are made without regard to race, color, religion, sex, national origin, age, disability, veteran status, marital or family status, sexual orientation, gender identity, or genetic information. All OpenKyber staff must be able to demonstrate the legal right to work in the United States. OpenKyber is an E-Verify employer
For applications and inquiries, contact: hirings@openkyber.com</div>

OCI Cloud Security Engineer

<div></div><div><div><div><div><ul><div>2 - 3 Years</div>
<div></div><div>1 Opening</div>
 <div>Hyderabad</div></ul></div><div> 
<div><div>
</div></div></div></div><div></div><div><h3 class="jobSectionHeader">Role description</h3>
<div>Role Overview 
The SIEM Senior Engineer is responsible for hands-on engineering, enrichment, and monitoring of security s using Splunk. This role focuses on building high-quality detections, enriching s with meaningful context, and improving SOC analyst efficiency by reducing false positives and improving signal quality. The role works closely with SOC Analysts, SIEM Leads, and Security Engineering teams. 
Key Responsibilities 
Engineer, maintain, and tune Splunk-based SIEM s and correlation rules. 
Monitor security s to ensure accuracy, relevance, and operational readiness. 
Continuously tune s to improve signal-to-noise ratio and reduce false positives. 
Implement enrichment using identity, asset, vulnerability, and threat intelligence data. 
Ensure s contain actionable context such as user, asset, privilege, and business impact. 
Support Splunk log onboarding, data normalization, and CIM compliance. 
Optimize SPL searches, dashboards, and saved searches. 
Support L2/L3 troubleshooting for SIEM s and ingestion issues. 
Develop detection use cases aligned to the MITRE ATT&amp;CK framework. 
Maintain SOPs, runbooks, and SIEM documentation. 
Required Skills &amp; Experience 
3-5 years of experience in SIEM, SOC, or Security Engineering roles. 
Strong hands-on experience with Splunk
 
Proven experience in SIEM creation, tuning, and enrichment. 
Strong understanding of security telemetry across endpoint, network, cloud, and IAM. 
Proficiency in SPL (Search Processing Language). 
Understanding of SOC workflows and incident triage. 
Familiarity with the MITRE ATT&amp;CK framework. 
Preferred Qualifications 
Experience integrating Splunk with IAM, CMDB, vulnerability, and threat intelligence tools. 
Exposure to SOAR platforms and automated response workflows. 
Scripting experience using Python or PowerShell. 
Experience working in regulated environments such as healthcare or financial services. 
Relevant Splunk or security certifications.</div> 
<h3 class="jobSectionHeader">Skills</h3>
<div>siem,security s, tuning, enrichment,</div></div></div></div>
 <div><h3 class="jobSectionHeader">About UST</h3>
<div>UST is a global digital transformation solutions provider. For more than 20 years, UST has worked side by side with the world&rsquo;s best companies to make a real impact through transformation. Powered by technology, inspired by people and led by purpose, UST partners with their clients from design to operation. With deep domain expertise and a future-proof philosophy, UST embeds innovation and agility into their clients&rsquo; organizations. With over 30,000 employees in 30 countries, UST builds for boundless impact&mdash;touching billions of lives in the process.</div></div>

SIEM Enrichment & Monitoring

Search 1483+ Splunk consultant jobs near you this May. New roles added regularly across leading industries. Apply today.