Splunk ITSI SME

Enterprise Horizon Consulting Group is seeking a Splunk IT Service Intelligence (ITSI) Subject Matter Expert (SME) to lead the design, implementation, and optimization of advanced Splunk monitoring and observability solutions within a complex Department of Defense (DoD) environment. This is a hands-on engineering role for a true Splunk expert who can architect innovative solutions, integrate new data sources, and drive the adoption of Splunk ITSI capabilities across the enterprise.

Key Responsibilities

• Architect, configure, and optimize Splunk within the DoD Secure Cloud Computing Architecture (SCCA) Virtual Datacenter Management Stack (VDMS) to support enterprise-wide log management, security auditing, and telemetry collection.
• Integrate Splunk observability solutions with DoD cloud broker frameworks and shared service boundaries to ensure seamless visibility across multi-cloud and hybrid environments.
• Align Splunk ITSI service health models and KPI structures with DoD cloud governance standards and operational readiness requirements.
• Design and implement new monitoring, observability, and service intelligence capabilities rather than simply maintaining existing platforms.
• Develop service health models, KPIs, service dependencies, and entity relationships to improve operational awareness and system reliability.
• Build and maintain custom Splunk ITSI Glass Tables, Deep Dives, and high-level dashboards to provide real-time operational visibility and executive service-health tracking.
• Configure and optimize Notable Event Aggregation Policies (NEAPs) in Splunk ES to consolidate redundant alerts, minimize false positives, and streamline incident triage for security analysts.
• Integrate and normalize security, infrastructure, application, and operational data from diverse enterprise data sources.
• Collaborate with cybersecurity, infrastructure, and operations teams to align monitoring capabilities with mission and business objectives.
• Evaluate emerging Splunk capabilities and recommend innovative solutions that enhance visibility, automation, and service health monitoring.
• Troubleshoot complex Splunk and ITSI issues, optimize platform performance, and improve scalability.
• Develop technical documentation, implementation plans, standard operating procedures, and knowledge transfer materials.
• Serve as the primary Splunk ITSI SME, providing technical leadership and strategic guidance on monitoring and observability initiatives.

Requirements

• Active Secret Clearance required.
• IAT II (Security+) or higher-level certification required.
• Strong knowledge of the DoD Secure Cloud Computing Architecture (SCCA) framework, specifically the Virtual Datacenter Management Stack (VDMS) and enterprise log management standards.
• Experience operating within Department of Defense (DoD) cloud-hosted ecosystems and collaborating with enterprise cloud service providers.
• Hands-on experience implementing and operationalizing Splunk ITSI in enterprise environments.
• Strong experience with Splunk Enterprise administration, engineering, or architecture.
• Strong understanding of service health modeling, KPI development, event correlation, and observability best practices.
• Experience integrating data from infrastructure, application, cloud, security, and operational systems.
• Strong troubleshooting, analytical, and problem-solving skills.
• Ability to lead technical discussions and translate requirements into scalable monitoring solutions.
• Excellent written and verbal communication skills.
• Splunk-related certification highly desired.