Cribl/Splunk Intel Developer

Role: Cribl/Splunk Intel Developer

Location: Wilmington, Delaware, Relocation is fine for EST or nearby states candidates

Contract: 6 Months

LinkedIn and DL/Visa

Must have 10 years of experience

Must Have

• Looking for someone to integrate threat intelligence into Cribl and Splunk.
• Looking for someone who understands pipeline management in Cribl, working with lookups.
• Ability to work with large datasets and optimize them for large retroactive queries. Experience in Splunk with content development.
  
  

We are looking for an experienced Cribl Engineer to join our team. In this role, you will be responsible for administering, configuring, and optimizing Cribl solutions within our enterprise environment. You should have hands-on experience with Cribl Lake, Cribl Search, and Cribl Stream, as well as expertise in setting up complex data routing, pipeline management, and integration of various data sources and destinations. The ideal candidate will have Cribl Certified Operations Engineer (CCOE) certifications and experience managing enterprise-level Cribl deployments.

Key Responsibilities

• Cribl Administration: Manage and administer Cribl deployments, ensuring optimal performance, security, and scalability across the environment. Oversee the setup and configuration of Cribl Stream, Cribl Search, and Cribl Lake instances.
• Enterprise Deployment: Set up and maintain enterprise-level Cribl deployments, configuring worker groups, and managing large-scale data routing, collection, and transformation pipelines.
• Pipeline Management: Create, optimize, and manage advanced pipelines for processing data at scale. Implement custom data processing workflows to handle diverse log and metric sources efficiently.
• Sources and Destinations Setup: Configure sources (e.g., syslog, file inputs, HTTP/S sources) and destinations (e.g., Splunk, Elasticsearch, AWS, etc.) for data ingestion and output. Ensure seamless integration of data flows and robust data integrity.
• Routing and Data Transformation: Set up advanced data routes and implement complex data transformation rules using Cribl's visual pipeline editor. Optimize routing for performance and accuracy in data handling.
• Cribl Lake Configuration: Oversee the setup and management of Cribl Lake for centralized storage, ensuring high availability, performance, and efficient data retrieval.
• Cribl Search Management: Configure and manage Cribl Search instances, ensuring seamless integration with data sources and destinations for efficient query performance and data retrieval.
• Optimization and Tuning: Continuously monitor Cribl's performance and optimize configurations for high throughput, low latency, and overall system efficiency, especially in large-scale enterprise deployments.
• Collaboration and Support: Work closely with other engineering teams, DevOps, and security operations teams to ensure the seamless flow of data and troubleshoot any data ingestion, transformation, or routing issues.
• Documentation: Create and maintain comprehensive documentation for Cribl deployment configurations, pipelines, and troubleshooting procedures. Ensure that best practices are documented for future scalability and support.
  
  

Required Skills And Qualifications

• Cribl Experience: At least 3-5 years of hands-on experience working with Cribl Stream, Cribl Search, and Cribl Lake in a production environment.
• Cribl Certified Operations Engineer (CCOE): Preferred certification as CCOE User and CCOE Admin to demonstrate expertise in managing Cribl deployments.
• Enterprise Deployment Experience: Strong experience in setting up and managing enterprise-level Cribl environments, including configuring worker groups and managing large-scale data ingestion.
• Advanced Pipeline Development: Deep knowledge of creating, managing, and optimizing data pipelines for efficient data processing, transformation, and routing.
• Data Sources & Destinations: Proficient in configuring and managing a wide range of data sources (e.g., syslog, cloud services, custom inputs) and destinations (e.g., Splunk, Elasticsearch, cloud storage, etc.).
• Troubleshooting & Optimization: Strong troubleshooting skills with a focus on optimizing performance, latency, and data integrity in Cribl configurations.
• Automation & Scripting: Experience with automation tools and scripting languages (e.g., Python, Shell) to streamline configurations and deployments.
• Cloud & Security Awareness: Familiarity with cloud platforms (e.g., AWS, Azure, GCP) and their integration with Cribl for data routing and storage. Strong understanding of data security best practices.
• Collaboration: Ability to collaborate effectively with cross-functional teams, including security engineers, DevOps, and other IT teams to ensure data flows are optimized and functional.
  
  

Preferred Qualifications

• Cribl Certifications: In addition to CCOE User and CCOE Admin, any other Cribl-specific certifications or advanced training will be considered a plus.
• Splunk, Elasticsearch or Similar SIEM Experience: Familiarity with SIEM platforms (e.g., Splunk, Elasticsearch) and how they integrate with Cribl for optimized data routing and transformation.
• Cloud Integrations: Experience with cloud-native tools and integrations, including the ability to manage Cribl deployments in cloud environments like AWS, Azure, or GCP.
  
  

DevOps/Automation Experience: Knowledge of DevOps tools and practices, including Terraform, Ansible, or similar for automation of Cribl infrastructure