Data Analytics Engineer
Data Analytics Engineer | Splunk & Cribl | SIEM Pipelines
We're hiring a Data Analytics Engineer to lead the migration, optimisation and secure operation of log ingestion and observability pipelines, with a focus on moving log sources from Splunk ingestion to Cribl Stream/Edge.
The role
- Lead the migration of log sources to load-balanced, fault-tolerant Cribl pipelines
- Design and run resilient pipelines for high ingest volumes (Cribl worker groups, external load balancers, syslog distribution)
- Onboard, parse and tune security log sources (firewalls, EDR, cloud, authentication, proxies), using data reduction to cut Splunk ingest and storage costs without losing security coverage
- Build and maintain Cribl and Splunk configs: transformations, field normalisation, masking, enrichment
- Work with SOC, IR and threat detection teams so security logs reach the SIEM reliably and are tuned for detection
- Monitor and resolve pipeline and SIEM issues, and report on ingest reduction, cost savings, pipeline health and event loss
- Document log flows, pipeline topology and operational procedures
What you'll bring
- Strong hands-on Splunk SIEM engineering (indexers, search heads, clustering, forwarders, CIM, performance optimisation)
- 2+ years with Cribl Stream/Edge, including distributed, load-balanced deployments
- Solid grasp of log transport (syslog, HEC, TCP, UDP) and balancing strategies in HA logging environments
- Proven experience onboarding and tuning security log sources for SOC/IR support
- Advanced SPL, data models, event parsing and alert tuning
- Scripting skills (Python, shell/CLI or similar) for pipeline management and validation
- Good troubleshooting skills and experience building monitoring dashboards
Details:
- £650 - £750 P/D
- Initial 6-month contract role (strong likelihood to extend)
- Hybrid role (2-3 days P/W on-site)
If the role sounds of interest, feel free to reach out or apply below.