Full-Time Data Analytics Architect

True Zero Technologies is seeking an experienced Data Analytics Architect to join our Data Analytics practice. The position leads the design, implementation, and administration of True Zero's federal government customer's enterprise data analytics suite, which includes Splunk, Cribl, and other industry-leading solutions. The position is primarily responsible for designing and architecting the customer's hybrid cloud/on-prem, enterprise data analytics solution. All candidates must possess significant design, implementation, and administration experience with Splunk Core, Splunk ES, and Cribl in AWS cloud, and have deep experience with S3 SmartStore configurations, along with experience troubleshooting and tuning SmartStore. Ideal candidates will possess the necessary certifications, work well in a team environment, and possess (or be willing to possess) a federal security clearance. Candidates with backgrounds supporting federal customers is a plus. Additionally, candidates with specific experience driving security content requirements and have broad experience working within and in support of Security Operation Center (SOC) teams will be preferred. Lastly, any additional skills with AWS cloud and Splunk Indexer Clustering is a plus.

As a TZT consultant, the candidate will receive access to the full knowledge base which is driven by the True Zero community as well as the technical backing of the entire PS team. True Zero encourages collaboration and growth through information sharing and knowledge workshops. The candidate will also have access to our internal Slack channel to stay connected with the team as well as the necessary tools to train, demo, test and grow their professional skills.

Preferred Qualifications

Splunk Core Consultant Certification

Adept at extracting value from data and establishing security use cases

Proficient in establishing standardized practices and documentation

Possess an understanding of Syslog daemon configuration principles, ideally in Syslog-NG and RSyslog configurations.

Experience with Government CDM Program

Familiarity with Government cyber/IT policies and frameworks, including M-21-31, FISMA, FEDRAMP, NIST 800-53, NIST 800-207, and Zero Trust, preferred

Familiarity with the aggregation tool Axonius

Development and API experience (Python, Perl, XML)

Ansible, Spacewalk, and other enterprise automation tool experience.

Hardware experience and storage experience (SAN, NAS, etc.)

Qualification Requirements

Minimum 8-10 years of relevant market experience required

Minimum 4-5 years of Splunk specific experience required

Minimum 2-3 years of Cribl specific experience required

Splunk Enterprise Security Implementation/Admin Certifications OR Accreditation

Splunk Architect Certification

Experience designing and implementing ground up distributed Splunk installations including all Splunk server roles (Search Head, Indexers, Heavy Forwarders and Universal Forwarders, etc.)

Experience with advanced configuration of Splunk including Indexer Clustering and Search Head Clustering.

Experience with S3 storage technologies, and specifically Splunk’s SmartStore indexer clustering technology.

Experience maintaining and administering enterprise Splunk implementations.

Experience developing custom Splunk content including scheduled searches, reports, dashboards, etc.

Proficient at data on-boarding activities including custom parsing rules, custom Technology Add-On building according to Splunk's Common Information Model (CIM).

Experience configuring indexes, index routing, retention policies, etc.

Cloud experience and/or certifications (AWS, Azure, etc.)

Cribl Certified - Admin and/or Cribl Certified - User certifications

Cribl Experience, working with source/destination definitions, pipelines and PACKS, as well as experience writing regular expressions and building routes.

Experience working in linux and windows environments, ability to configure: 

Storage subsystems (I.e. partitioning, Volume Groups, Logical Volumes, etc.)

SELinux

Familiarity with different flavors of Linux distros (RedHat, CentOS, Ubuntu, etc.)

File Permission Settings (linux/windows)

Excellent written and oral skills, ability to work closely with multiple customers, manage expectations, and track engagement scope.

Ability to hold a Clearance is required.