Splunk ITSI Engineer

Overview

Nakupuna Companies is looking for a Splunk ITSI Engineer. Lead the architecture, deployment, configuration, and operationalization of Splunk IT Service Intelligence (ITSI) for Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC). The engineer will work with the existing Splunk team to bring security and IT data into a unified monitoring view, improve visibility into service health, reduce alert noise, and help teams identify issues before they disrupt operations. This role will build service health models, alert aggregation policies, and dashboards that reflect vulnerability management priorities and the organization’s risk posture.

Responsibilities

The following reflects management’s definition of essential functions for this position.  Management may assign additional duties and responsibilities to this job at any time due to reasonable accommodation or other reasons.

• Lead the design, installation, hardening, configuration, and operationalization of Splunk ITSI in coordination with the existing Splunk engineering team.
• Ingest and normalize security, application, and infrastructure telemetry from disparate data sources; assess log quality, field consistency, and collection methods.
• Define ITSI entities, services, key performance indicators (KPIs), thresholds, and dependencies to provide proactive service health monitoring.
• Develop and tune Notable Event Aggregation Policies (NEAP) to correlate related events, reduce duplicate alerts, and support incident investigation.
• Build Glass Tables, Deep Dives, and executive dashboards that present real-time service health, trends, and operational risk.
• Align service health models and alerting with vulnerability management priorities in consultation with Government cybersecurity and operations stakeholders.
• Configure and troubleshoot related Splunk searches, alerts, reports, visualizations, add-ons, and data onboarding within the existing platform.
• Support secure configuration and access controls in accordance with applicable DoD and DON requirements, DISA STIGs, and the Risk Management Framework.
• Validate data flows, ITSI calculations, dashboards, and event grouping; refine configurations as operational needs evolve.
• Document architecture, configurations, standard operating procedures, lessons learned, and best practices; provide training and knowledge transfer to NAVSUP BSC personnel.
• Provide weekly status updates on work completed, remaining tasks, dependencies, and issues.

Qualifications

Skills/Qualifications:

• Experience designing, installing, administering, and troubleshooting Splunk ITSI in a Splunk Enterprise environment.
• Ability to model IT services, entities, KPIs, health scores, thresholds, and dependencies that reflect operational priorities.
• Experience with ITSI Glass Tables, Deep Dives, Event Analytics, Notable Event Aggregation Policies, and Episode Review.
• Strong Splunk Search Processing Language (SPL) skills and experience developing searches, alerts, reports, dashboards, and data models.
• Experience onboarding, normalizing, and correlating logs and telemetry from security, application, and infrastructure systems.
• Knowledge of Splunk forwarders, search and deployment servers, clustered indexers, add-ons, and data collection methods such as Syslog, JDBC, and APIs.
• Experience with Linux and Windows environments and with Splunk configuration files, field extractions, lookups, and access controls.
• Ability to work with Government cybersecurity and operations teams on vulnerability priorities, secure configuration, continuous monitoring, auditing, and reporting.
• Experience developing technical documentation, training users, communicating progress, and resolving dependencies across teams.

Education and Experience: A bachelor’s degree in a technical field, such as engineering or computer science, is required. Experience in Government or DoD environments is desired.

Certification:

This position requires:

• CompTIA Security+ CE certification or an equivalent certification approved for the position.

Additionally, candidates must have ONE of the following Splunk certifications; the ITSI certification is preferred:

• Splunk IT Service Intelligence Certified Admin (Legacy)
• Splunk Enterprise Certified Admin
• Splunk Enterprise Certified Architect
• Splunk Cloud Certified Admin
• Splunk Enterprise Security Certified Admin
• Splunk Certified Developer

The Nakupuna Companies use a market-based compensation strategy to ensure that our employees are compensated within applicable market ranges commensurate with multiple factors, including but not limited to the individual’s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability, organizational requirements, and position location. The projected compensation range for this position is $150,000.00 to $165,000.00 (annualized USD). The salary range displayed represents the typical salary range for this position and is just one component of Nakupuna Companies total compensation package for employees.