Data Analytics Engineer

Data Analytics Engineer | Splunk & Cribl | SIEM Pipelines

We're hiring a Data Analytics Engineer to lead the migration, optimisation and secure operation of log ingestion and observability pipelines, with a focus on moving log sources from Splunk ingestion to Cribl Stream/Edge.

The role

Lead the migration of log sources to load-balanced, fault-tolerant Cribl pipelines

Design and run resilient pipelines for high ingest volumes (Cribl worker groups, external load balancers, syslog distribution)

Onboard, parse and tune security log sources (firewalls, EDR, cloud, authentication, proxies), using data reduction to cut Splunk ingest and storage costs without losing security coverage

Build and maintain Cribl and Splunk configs: transformations, field normalisation, masking, enrichment

Work with SOC, IR and threat detection teams so security logs reach the SIEM reliably and are tuned for detection

Monitor and resolve pipeline and SIEM issues, and report on ingest reduction, cost savings, pipeline health and event loss

Document log flows, pipeline topology and operational procedures

What you'll bring

Strong hands-on Splunk SIEM engineering (indexers, search heads, clustering, forwarders, CIM, performance optimisation)

2+ years with Cribl Stream/Edge, including distributed, load-balanced deployments

Solid grasp of log transport (syslog, HEC, TCP, UDP) and balancing strategies in HA logging environments

Proven experience onboarding and tuning security log sources for SOC/IR support

Advanced SPL, data models, event parsing and alert tuning

Scripting skills (Python, shell/CLI or similar) for pipeline management and validation

Good troubleshooting skills and experience building monitoring dashboards

Details:

£650 - £750 P/D

Initial 6-month contract role (strong likelihood to extend)

Hybrid role (2-3 days P/W on-site)

If the role sounds of interest, feel free to reach out or apply below