The Senior Splunk ITSI Engineer owns the service intelligence layer of a federal customer’s Splunk environment, modeling services, designing KPIs, and tuning event analytics.
Locations (2)
Washington, District of Columbia, United States
Maryland, United States
Compensation
$165,000 to $195,000 annually
Responsibilities
Design, build, and maintain ITSI service trees, including service decomposition, entity definition and discovery, dependency mapping, and service templates.
Develop KPIs and shared KPI base searches, and configure static and adaptive (machine learning) thresholds, time policies, and health score weighting.
Create and maintain glass tables, deep dives, and service analyzer views for NOC, operations, and executive audiences.
Build and tune event analytics, including correlation searches, notable event aggregation policies, episode review workflows, and ITSM integration (ServiceNow or equivalent) for ticketing.
Lead and optimize large-scale Splunk Enterprise Security deployments to support Security Operations Centers, ensuring architecture, performance, and integration with SOAR platforms.
Locations (16)
Washington, District of Columbia, United States
California, United States
Colorado, United States
Connecticut, United States
Hawaii, United States
Onboard and normalize data sources feeding ITSI, including Common Information Model (CIM) compliance, entity enrichment, and content pack deployment.
As required by local law, Accenture Federal Services provides reasonable ranges of compensation for hired roles based on labor costs in the states of California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia. The base pay range for this position in these locations is: $109,500—$224,200 USD
Responsibilities
Own Splunk Enterprise Security architecture, sizing, and platform health management.
Develop and tune correlation rules and use cases mapped to the MITRE ATT&CK framework.
Onboard new log sources and normalize data across a large, diverse endpoint environment.
Build and maintain SIEM-to-SOAR integrations that drive automated alert enrichment and response.
Produce Splunk platform performance reporting and capacity-planning recommendations.
Requirements
Bachelor's degree in Computer Science, Information Technology, or related field (equivalent experience considered)
Nice to have: Splunk Certified Architect
Nice to have: Splunk Enterprise Security Certified Admin
