Abra Professional Services is seeking a Splunk Developer.
We are looking for a skilled Splunk Developer to join a SIEM team within a leading financial organization. The role involves developing and maintaining Splunk-based security solutions, integrating log sources, creating dashboards and detection content, and enhancing monitoring capabilities across the organization's cyber security environment.
This role requires strong expertise in Splunk Enterprise/Cloud, advanced SPL development, Python programming, and React development, alongside a deep understanding of SIEM and security monitoring technologies.
A full-time, on-site position, based in Central Israel.
Key Responsibilities:
- Develop and maintain solutions on the Splunk platform.
- Design and build advanced dashboards, reports, alerts, and saved searches.
- Create, optimize, and maintain detection rules and monitoring content.
- Integrate and onboard new data sources using Syslog, HEC, REST APIs, and other ingestion methods.
- Develop backend components and automations using Python.
- Build and maintain internal operational tools and user interfaces using React.
- Perform performance tuning and search optimization across the Splunk environment.
- Collaborate with cyber security, infrastructure, and operations teams to improve monitoring and detection capabilities.
Requirements
Requirements:
- 3+ years of hands-on experience with Splunk Enterprise and/or Splunk Cloud.
- Strong experience writing advanced SPL queries, including joins, stats, tstats, transactions, and lookups.
- Experience developing and maintaining dashboards, alerts, reports, and saved searches.
- Experience implementing and managing data inputs via Syslog, HEC, and REST APIs.
- Strong understanding of indexes, sourcetypes, props.conf, and transforms.conf.
- Experience with Splunk performance tuning and search optimization.
- 2+ years of Python development experience.
- Experience working with REST APIs, JSON/XML parsing, and data normalization.
- Experience developing applications with React, including Hooks, Components, and State Management.
- Strong knowledge of JavaScript ES6+, HTML, and CSS.
Advantages:
- Experience with Splunk SOAR.
- Experience in Cyber Security, SIEM, or SOC environments.
- Experience integrating with cloud platforms (AWS, Azure, GCP).
- Experience integrating security tools such as EDR, IAM, and CI/CD solutions.
- Experience working with Git and CI/CD pipelines.
- Familiarity with Docker and Kubernetes.
- Splunk certifications (Power User, Admin, Architect).
- Academic degree in Computer Science, Information Systems, Cyber Security, or a related field