About this role

The Splunk, ITSI & Cribl Engineer is responsible for engineering, operating, maintaining, and enhancing enterprise observability and security telemetry platforms. The role focuses on Splunk Enterprise, Splunk IT Service Intelligence (ITSI), Splunk Enterprise Security (ES), and Cribl, supporting the collection, processing, monitoring, and analysis of operational and cybersecurity data.

The engineer will work with Information Security, infrastructure, cloud, network, application, and operations teams to deliver reliable and secure telemetry solutions.

Key Responsibilities

• Configure, administer, maintain, and troubleshoot Splunk Enterprise environments.
• Develop and maintain Splunk ITSI services, KPIs, health scores, dashboards, alerts, and service monitoring.
• Configure and maintain Cribl pipelines for telemetry collection, routing, filtering, parsing, enrichment, and transformation.
• Support Splunk Enterprise Security (ES) and security monitoring capabilities.
• Onboard telemetry from applications, operating systems, cloud platforms, network infrastructure, security technologies, and enterprise services.
• Develop SPL searches, dashboards, alerts, reports, and other Splunk knowledge objects.
• Support Splunk CIM normalization and data models used by security analytics.
• Troubleshoot data ingestion, parsing, timestamping, field extraction, indexing, forwarding, and search issues.
• Monitor Splunk and Cribl platform health, capacity, data availability, and performance.
• Support telemetry integrations using syslog, REST APIs, HTTP Event Collector (HEC), Universal Forwarders, and other collection methods.
• Assist with Splunk, ITSI, and Cribl installations, upgrades, configuration changes, and platform maintenance.
• Work with Security Operations and Detection Engineering teams to ensure appropriate telemetry is available for security monitoring, investigations, and detections.
• Assist with automation of platform administration, deployment, configuration, and monitoring activities.
• Maintain technical documentation, operational procedures, onboarding documentation, and engineering runbooks.
• Participate in troubleshooting and incident-response activities involving security telemetry and observability platforms.
• Collaborate with technology teams to improve the reliability, quality, and usability of enterprise telemetry.

Required Qualifications

• Hands-on experience with Splunk Enterprise administration or engineering.
• Experience with Splunk ITSI or enterprise monitoring/observability technologies.
• Experience with Cribl Stream or similar telemetry pipeline technologies.
• Working knowledge of SPL.
• Experience onboarding and troubleshooting machine data.
• Understanding of parsing, field extraction, timestamps, metadata, indexing, and data routing.
• Familiarity with dashboards, alerts, reports, and Splunk knowledge objects.
• Understanding of SIEM and cybersecurity logging principles.
• Familiarity with Linux/Unix, networking, syslog, REST APIs, certificates, and enterprise infrastructure.
• Strong analytical and troubleshooting skills.
• Ability to collaborate across security and technology teams.

Preferred Qualifications

• Splunk Enterprise Security experience
• Splunk ITSI experience
• Cribl Stream experience
• Splunk or Cribl certifications
• AWS and/or Azure logging experience
• Splunk CIM and data model experience
• Python or shell scripting experience
• Git/source-control experience
• Exposure to detection engineering and security operations
• Experience with distributed or clustered Splunk environments

Our benefits

To help you stay energized, engaged and inspired, we offer a wide range of benefits including a strong retirement plan, tuition reimbursement, comprehensive healthcare, support for working parents and Flexible Time Off (FTO) so you can relax, recharge and be there for the people you care about.

Our hybrid work model

BlackRock’s hybrid work model is designed to enable a culture of collaboration and apprenticeship that enriches the experience of our employees, while supporting flexibility for all. Employees are currently required to work at least 4 days in the office per week, with the flexibility to work from home 1 day a week. Some business groups may require more time in the office due to their roles and responsibilities. We remain focused on increasing the impactful moments that arise when we work together in person – aligned with our commitment to performance and innovation. As a new joiner, you can count on this hybrid model to accelerate your learning and onboarding experience here at BlackRock.

Guidance on AI use for candidates

At BlackRock, AI has long been part of how we work – enhancing decision-making, improving operations, and helping us deliver better outcomes for clients. We encourage candidates to use AI thoughtfully to learn, prepare, and work more effectively; but during our interview process, we want to focus on getting to know you through your own experiences, thinking, and judgment. To support you, we’ve provided guidance on when and how to use AI during our hiring process so you can approach each step with confidence and showcase your best self.

About BlackRock

At BlackRock, we are all connected by one mission: to help more and more people experience financial well-being.  Our clients, and the people they serve, are saving for retirement, paying for their children’s educations, buying homes and starting businesses. Their investments also help to strengthen the global economy: support businesses small and large; finance infrastructure projects that connect and power cities; and facilitate innovations that drive progress.

This mission would not be possible without our smartest investment – the one we make in our employees. It’s why we’re dedicated to creating an environment where our colleagues feel welcomed, valued and supported with networks, benefits and development opportunities to help them thrive.

To learn more about BlackRock, please visit Careers.BlackRock.com. We also encourage you to get to know us on LinkedIn, Instagram, YouTube, X, and TikTok.

BlackRock is proud to be an Equal Opportunity Employer.  We evaluate qualified applicants without regard to age, disability, family status, gender identity, race, religion, sex, sexual orientation and other protected attributes at law.