Track Lead - IT security

Job Summary

The Splunk / Cribl System Architect is responsible for designing, operating, and continuously optimizing Wacker’s centralized security analytics and observability platform.\r\n The role ensures high‑quality data ingestion, platform scalability, cost efficiency, and operational resilience, supporting SOC, IT operations, and compliance use cases across on‑premises and cloud environments.

Key Responsibilities

Platform Architecture & Engineering\r\n\r\n Design, implement, and maintain Splunk platform architectures (Search Head Clusters, Indexer Clusters, Forwarders, Deployment Server, Smart Store where applicable).\r\n Design and operate Cribl architectures (Cribl Stream, pipelines, routing, and filtering strategies).\r\n Ensure high availability, scalability, security, and performance of the logging and analytics platform. Job Descri...Architect | Word\r\n\r\n Data Ingestion, Normalization & Quality\r\n\r\n Design and manage log ingestion pipelines from infrastructure, applications, network devices, cloud platforms, and security tools.\r\n Define and enforce data parsing, enrichment, and normalization standards (e.g., CIM alignment).\r\n Ensure data reliability, completeness, and fitness for detection, monitoring, and compliance use cases.\r\n\r\n Performance, Capacity & Cost Optimization\r\n\r\n Perform capacity planning, performance tuning, and platform optimization for high‑volume log environments.\r\n Optimize data flows using Cribl to control ingestion costs and improve downstream efficiency.\r\n Monitor platform health and proactively mitigate performance or scaling risks.\r\n\r\n Security Operations & Compliance Enablement\r\n\r\n Support SOC and ITSOC use cases including detection, investigation, and monitoring.\r\n Ensure platform configurations align with security, compliance, and audit requirements.\r\n Support incident investigations by providing reliable, timely, and structured log data.\r\n\r\n Governance, Automation & Continuous Improvement\r\n\r\n Establish platform standards, runbooks, and operational documentation.\r\n Identify and implement automation opportunities to improve platform operations and reliability.\r\n Collaborate with security engineers, IT operations, and application teams to onboard new use cases and log sources.

Skill Requirements

5+ years of experience with Splunk platform engineering and administration.\r\n Hands‑on expertise with Cribl Stream / Edge for log routing, filtering, and optimization.\r\n Strong knowledge of SPL, log parsing, and analytics design.\r\n Experience supporting SOC / SIEM / observability platforms in enterprise environments.\r\n Familiarity with cloud platforms, Linux, networking, and security concepts.

Other Requirements

No