Vice President. Cyber Observability

About this role

The Splunk Security Engineer will design, engineer, operate, and enhance Splunk-based cybersecurity capabilities supporting enterprise security monitoring, threat detection, incident response, and security analytics. The role will partner closely with Security Operations, Detection Engineering, Incident Response, Cyber Engineering, and infrastructure teams to ensure security telemetry is reliably collected, normalized, searchable, and actionable.

Key Responsibilities

• Engineer, administer, and optimize Splunk Enterprise and Splunk Enterprise Security (ES).
• Develop and maintain security detections, correlation searches, alerts, dashboards, reports, and investigative workflows.
• Onboard security telemetry from endpoints, networks, firewalls, identity platforms, cloud environments, applications, and other cybersecurity technologies.
• Develop and maintain Splunk Common Information Model (CIM) compliant data sources and associated data models.
• Perform data parsing, field extraction, normalization, enrichment, filtering, and routing.
• Partner with SOC and Detection Engineering teams to translate security requirements and threat scenarios into Splunk detections and analytics.
• Support incident response and threat-hunting activities through advanced SPL searches and security data analysis.
• Tune detections to improve fidelity and reduce unnecessary alert volume.
• Troubleshoot data ingestion, indexing, search performance, and Splunk ES issues.
• Monitor Splunk platform health, capacity, indexing performance, search performance, and data availability.
• Support distributed Splunk architectures, including search heads, indexers, forwarders, deployment components, and clustered environments.
• Integrate Splunk with enterprise security technologies and cloud platforms using APIs, syslog, agents, Universal Forwarders, and other collection mechanisms.
• Maintain appropriate Splunk RBAC, application permissions, and security controls.
• Create technical documentation, operational procedures, data onboarding standards, and engineering runbooks.
• Collaborate across Information Security and Technology teams to deliver secure and scalable logging and monitoring solutions.

That aligns well with the Splunk security work already reflected internally. Your previous material specifically calls out Splunk ES, data onboarding/parsing/normalization, dashboards and alerts, troubleshooting, health checks, SIEM principles, and partnership with security operations.  Another internally shared role also emphasizes distributed/clustered Splunk architecture, CIM compliance, integrations, maintenance, and security monitoring.

Required Qualifications

• Hands-on experience with Splunk Enterprise and Splunk Enterprise Security.
• Strong SPL development and troubleshooting skills.
• Understanding of SIEM, security monitoring, detection engineering, and incident-response principles.
• Experience onboarding and normalizing security telemetry.
• Knowledge of Splunk CIM and data models.
• Experience creating alerts, dashboards, reports, and security analytics.
• Understanding of large-scale Splunk architecture and data ingestion.
• Strong troubleshooting and analytical skills.
• Ability to work effectively across cybersecurity and infrastructure engineering teams.

Our benefits

To help you stay energized, engaged and inspired, we offer a wide range of benefits including a strong retirement plan, tuition reimbursement, comprehensive healthcare, support for working parents and Flexible Time Off (FTO) so you can relax, recharge and be there for the people you care about.

Our hybrid work model

BlackRock’s hybrid work model is designed to enable a culture of collaboration and apprenticeship that enriches the experience of our employees, while supporting flexibility for all. Employees are currently required to work at least 4 days in the office per week, with the flexibility to work from home 1 day a week. Some business groups may require more time in the office due to their roles and responsibilities. We remain focused on increasing the impactful moments that arise when we work together in person – aligned with our commitment to performance and innovation. As a new joiner, you can count on this hybrid model to accelerate your learning and onboarding experience here at BlackRock.

Guidance on AI use for candidates

At BlackRock, AI has long been part of how we work – enhancing decision-making, improving operations, and helping us deliver better outcomes for clients. We encourage candidates to use AI thoughtfully to learn, prepare, and work more effectively; but during our interview process, we want to focus on getting to know you through your own experiences, thinking, and judgment. To support you, we’ve provided guidance on when and how to use AI during our hiring process so you can approach each step with confidence and showcase your best self.

About BlackRock

At BlackRock, we are all connected by one mission: to help more and more people experience financial well-being.  Our clients, and the people they serve, are saving for retirement, paying for their children’s educations, buying homes and starting businesses. Their investments also help to strengthen the global economy: support businesses small and large; finance infrastructure projects that connect and power cities; and facilitate innovations that drive progress.

This mission would not be possible without our smartest investment – the one we make in our employees. It’s why we’re dedicated to creating an environment where our colleagues feel welcomed, valued and supported with networks, benefits and development opportunities to help them thrive.

To learn more about BlackRock, please visit Careers.BlackRock.com. We also encourage you to get to know us on LinkedIn, Instagram, YouTube, X, and TikTok.

BlackRock is proud to be an Equal Opportunity Employer.  We evaluate qualified applicants without regard to age, disability, family status, gender identity, race, religion, sex, sexual orientation and other protected attributes at law.