Senior Splunk Engineer

The company is a technology service provider and leading outsourced partner focused on delivering professional and managed solutions across the EMEA region. We are seeking a seasoned Senior Splunk Engineer who thrives on solving complex data challenges and building high-impact security and observability solutions. If you are passionate about transforming machine data into meaningful insights and possess deep expertise in both Splunk Core and Splunk Enterprise Security (ES), this role provides the autonomy and scale to make a significant impact.

What You’ll Do:

• Lead the design, deployment, and optimization of Splunk Core and ES environments.
• Develop advanced SPL queries, dashboards, correlation searches, and data models.
• Own onboarding and normalization of new data sources across security and operational domains.
• Enhance ES use cases, risk-based alerting, notable events, and threat detection logic.
• Drive best practices for data ingestion, CIM compliance, and platform performance.
• Collaborate with Security Operations, Infrastructure, and Application teams to deliver end-to-end solutions.
• Act as a subject matter expert for Splunk architecture, scaling, and troubleshooting.
• Support automation and integration efforts using APIs, SOAR, and scripting where appropriate.

What You Bring:

• Extensive hands-on experience with Splunk Core (search head clustering, indexer clustering, data onboarding, SPL optimization).
• Strong expertise with Splunk Enterprise Security, including correlation searches, threat intelligence, RBAC, and ES content customization.
• Solid understanding of security operations, SIEM concepts, and detection engineering.
• Experience with data pipelines, log formats, and CIM mapping.
• Ability to work independently, lead technical initiatives, and mentor junior engineers.
• Scripting experience (Python, Bash, PowerShell) is a plus.
• Splunk certifications (Core Consultant, ES Analyst/Admin/Architect) are highly desirable.

Location: Riyadh, Saudi Arabia
Work Conditions: On-site, Full-time
Language Requirements: None specified.