Track Lead - IT security

Job Summary

The Splunk / Cribl System Architect is responsible for designing, operating, and continuously optimizing Wacker’s centralized security analytics and observability platform.\r\nThe role ensures high‑quality data ingestion, platform scalability, cost efficiency, and operational resilience, supporting SOC, IT operations, and compliance use cases across on‑premises and cloud environments.

Key Responsibilities

Platform Architecture & Engineering\r\n\r\nDesign, implement, and maintain Splunk platform architectures (Search Head Clusters, Indexer Clusters, Forwarders, Deployment Server, SmartStore where applicable).\r\nDesign and operate Cribl architectures (Cribl Stream, pipelines, routing, and filtering strategies).\r\nEnsure high availability, scalability, security, and performance of the logging and analytics platform. [Job Descri...Architect | Word]\r\n\r\nData Ingestion, Normalization & Quality\r\n\r\nDesign and manage log ingestion pipelines from infrastructure, applications, network devices, cloud platforms, and security tools.\r\nDefine and enforce data parsing, enrichment, and normalization standards (e.g., CIM alignment).\r\nEnsure data reliability, completeness, and fitness for detection, monitoring, and compliance use cases.\r\n\r\nPerformance, Capacity & Cost Optimization\r\n\r\nPerform capacity planning, performance tuning, and platform optimization for high‑volume log environments.\r\nOptimize data flows using Cribl to control ingestion costs and improve downstream efficiency.\r\nMonitor platform health and proactively mitigate performance or scaling risks.\r\n\r\nSecurity Operations & Compliance Enablement\r\n\r\nSupport SOC and ITSOC use cases including detection, investigation, and monitoring.\r\nEnsure platform configurations align with security, compliance, and audit requirements.\r\nSupport incident investigations by providing reliable, timely, and structured log data.\r\n\r\nGovernance, Automation & Continuous Improvement\r\n\r\nEstablish platform standards, runbooks, and operational documentation.\r\nIdentify and implement automation opportunities to improve platform operations and reliability.\r\nCollaborate with security engineers, IT operations, and application teams to onboard new use cases and log sources.

Skill Requirements

5+ years of experience with Splunk platform engineering and administration.\r\nHands‑on expertise with Cribl Stream / Edge for log routing, filtering, and optimization.\r\nStrong knowledge of SPL, log parsing, and analytics design.\r\nExperience supporting SOC / SIEM / observability platforms in enterprise environments.\r\nFamiliarity with cloud platforms, Linux, networking, and security concepts. 

Other Requirements

No