Cribl Engineer - Public Trust or higher Preferred (R-00040)

True Zero Technologies, a veteran-owned small business, was founded on the principle that the purposeful enablement of people and technology in an organization directly ties to the quality of its outcomes. True Zero recognizes that said outcomes begin and end with our people, and that is what we have built, a community of like-minded, driven, and passionate individuals and innovators who are aligned in a common goal of delivering top tier services to our customers. In 2023, True Zero was recognized as a “Best Places to Work” in two categories ("Prosperous and Thriving" ($5MM – $50MM in gross revenue) and "Mid-Atlantic Region" (DC, DE, MD, NC, VA, WV)) and in 2022, was recognized as one of Inc. Magazine’s Top 5000 Fastest Growing Companies.

The candidate will be part of a team of Engineers maintaining various clients' Cribl and Splunk instances with a heavy emphasis on Cribl pipeline development, parsing, tuning, and content enablement in both Cribl and Splunk. The ideal candidate will have a proven track record in managing and optimizing production environments for these platforms and will hold relevant certifications and work well in a team environment. Candidates with backgrounds supporting federal customers is a plus.

As a TZT consultant, the candidate will receive access to the full knowledge base which is driven by the True Zero community as well as the technical backing of the entire PS team. True Zero encourages collaboration and growth through information sharing and knowledge workshops. The candidate will also have access to our internal Slack channel to stay connected with the team as well as the necessary tools to train, demo, test and grow their professional skills.

• Minimum Cribl Certified Admin Certification(or commensurate experience)
• Minimum Splunk Architect Certification (or commensurate experience)
• Proven experience in production environments for both Cribl and Splunk hosted in AWS environments.
• Strong expertise in data parsing, pipeline development, and tuning within Cribl.
• Deep understanding of Splunk architecture, data models, and advanced search techniques.
• Expertise in implementing and supporting Splunk Enterprise Security use cases.
• Ability to troubleshoot and resolve production issues in both Cribl and Splunk environments.
• Collaborate with stakeholders to gather requirements and deliver tailored solutions.
• Experience designing and implementing ground up Cribl installations.
• Experience designing and implementing ground up distributed Splunk installations including all Splunk server roles (Search Head, Indexers, Heavy Forwarders and Universal Forwarders, etc.)
• Experience with advanced configuration of Splunk, including Indexer Clustering and Search Head Clustering.

• Experience developing custom Splunk content including scheduled searches, reports, dashboards, etc.
• Proficient at data on-boarding activities including custom parsing rules, custom Technology Add-On building according to Splunk's Common Information Model (CIM).
• Experience configuring indexes, index routing, retention policies, etc.
• Experience working in linux and windows environments, ability to configure:
• Storage subsystems (I.e. partitioning, Volume Groups, Logical Volumes, etc.)
• SELinux
• Familiarity with different flavors of Linux distros (RedHat, CentOS, Ubuntu, etc.)
• File Permission Settings (linux/windows)
• Excellent written and oral skills, ability to work closely with multiple customers, manage expectations, and track engagement scope.

• Cribl Certified Service Consultant Certification
• Splunk Core Consultant Certification
• Splunk Enterprise Security Implementation Certification
• AWS Solutions Architect Associate/Professional (or commensurate experience)
• Knowledge of how to normalize data with Common Information Model (CIM) mappings.

• Maintain compliance with security frameworks such as NIST, MITRE ATT&CK, and other regulatory standards.
• Leverage AWS services such as S3, Kinesis, Lambda, EC2 and IAM for data ingestion and operational workflows.
• Experience with risk-based alerting (RBA) and advanced correlation search strategies in Splunk ES.
• Development and API experience (Python, Perl, XML)
• SaltStack, Ansible, and other enterprise automation tool experience.
• Hardware experience and storage experience (SAN, NAS, etc.)

U.S. Citizenship is required as this is in support of a Federal Customer.

We’re actively searching for talented security and technology practitioners who are ready to experience the True Zero difference. As a True Zero team member, you'll enjoy:

- Competitive salary, paid twice per month

- Best in class medical coverage

- 100% of medical premiums covered by True Zero

- Company wide new business incentive programs

- Contribution Incentives (i.e. white papers, blog posts, internal webinars, etc.)

- 3 weeks of PTO starting + 11 Paid Holidays Annually

- 401k Program with 100% company match on the first 4%

- Monthly reimbursement of Cell Phone and Home Internet costs

- Paternity/Maternity Leave

- Investment in training and certifications to broaden and deepen your technical skills