About the position

Onboard new systems and data sources into the City's enterprise Splunk Cloud environment and developing dashboards, alerts, and analytics to improve operational visibility, security posture, and service reliability.



This role is highly technical and requires strong expertise in Splunk administration, data onboarding, and SPL (Search Processing Language) development.



Key Responsibilities

• Onboard new systems, logs, and data sources into Splunk, ensuring proper parsing, field extractions, CIM compliance, and data normalization.

• Configure and maintain forwarders, ingestion pipelines, and data routing.

• Build advanced dashboards, visualizations, and analytics for operational, security, and business use cases.

• Develop complex SPL queries, macros, lookups, and scheduled searches.

• Troubleshoot ingestion issues, search performance...