UIC is seeking a Lead Splunk Engineer to join our Cybersecurity Engineering team. This role will be a leader and partner responsible for the configuration, maintenance, and optimization of the Splunk service, playing a pivotal role in supporting the organization's compliance, monitoring, data analysis, and operational intelligence needs. Collaborating with internal and external teams, the Splunk Engineer will ensure that Splunk meets business, operational, and security needs while staying current on industry best practices and emerging technologies. Responsibilities encompass building custom apps and add-ons, designing dashboards, alerts, and reports, managing updates, and providing user support.

This position is within the Technology Solutions department at the University of Illinois Chicago (UIC), where we play a crucial role in supporting approximately 34,000 students and 16,000 employees across various domains, including teaching, learning, research, patient care, administration, and innovation. At Technology Solutions our focus is providing central IT services to 16 academic colleges, including eight health science colleges within the Chicago, Rockford, and Peoria campuses, in addition to providing support to the Division of Specialized Care of Children and the University of Illinois Hospital.

Joining the Technology Solutions Information Security team means stepping into a pivotal role within our university community. As a campus leader, you'll have the opportunity to help safeguard vital systems and data and actively contribute to the academic and operational success of UIC.
Duties & Responsibilities:

• Maintain and customize Splunk queries, dashboards, alerts, reports, and SOAR playbooks in collaboration with cybersecurity analysts to enhance threat visibility and automate security processes to support organizational requirements.
• Install, configure, and maintain Splunk apps across the campus, ensuring optimal performance and reliability; collaborate with system administrators and other stakeholders to integrate Splunk into existing infrastructure.
• Monitor and troubleshoot Splunk performance issues, proactively addressing potential bottlenecks and optimizing configurations and closely collaborate with IT teams to maintain service availability and reliability.
• Partner with cybersecurity analysts and IT teams to seamlessly integrate data sources into Splunk using the Splunk Common Information Model (CIM) for effective threat detection and incident response.
• Provide comprehensive training and user support to empower end-users in leveraging Splunk for log analysis, troubleshooting, and reporting effectively.
• Remain abreast of Splunk updates, industry trends, and best practices, offering informed recommendations for improvements and optimizations aligned with the organization's goals.
• Perform other related duties and participate in special projects as assigned.