Data warehousing specialist - network engineering

- Develop and implement best practices and tools for data ingestion, indexing, and management to enhance data sourcing and optimize data intake processes - Plan and execute Cribl platform upgrades, ensuring adherence to change control protocols - Oversee and enhance the Cribl distributed infrastructure, focusing on scalability, reliability, and effective data routing - Continuously assess Cribl performance metrics including throughput, queue depth, and worker health - Create and sustain Cribl pipelines for new data sources, incorporating filtering, sampling, and enrichment strategies - Transfer existing Splunk forwarder-based data inputs to Cribl for better control and flexibility - Construct and maintain Cribl Packs for consistent configurations across various environments - Implement workflows for data reduction and quality enhancement to decrease ingestion volume - Manage and refine Ansible playbooks for automated deployments, configurations, and updates - Integrate GitOps CI/CD pipelines (e.g., GitLab, Jenkins, Terraform) for configuration management of both Splunk and Cribl - Develop, test, and review merge requests related to dashboards, alerts, saved searches, and data onboarding pipelines - Undertake Splunk core upgrades to guarantee backward compatibility and minimal service interruption - Upgrade and validate Splunk Add-ons and Apps to ensure functionality and compliance with CIM - Create and maintain custom configurations to ensure consistent data normalization - Ensure CIM compliance for all add-ons and sourcetypes utilized on the platform - Address escalations from Operations, conducting in-depth troubleshooting on ingestion, parsing, and performance issues - Analyze and resolve issues related to Splunk core services like KVStore, clustering, and deployment server - Conduct performance tuning for optimal search efficiency and effective bucket management - Design and implement retention, archival, and indexing strategies in line with business and compliance objectives - Manage license distribution, volume forecasting, and capacity planning for indexer clusters - Develop monitoring and alerting systems for the health of Cribl and Splunk infrastructure - Collaborate with Operations on incident management, root cause analysis, and postmortem documentation - Create and maintain operational runbooks and engineering documentation for deployments, updates, and troubleshooting - Engage in architecture and design discussions to ensure Splunk and Cribl are scalable and reliable for enterprise needs - Implement security and compliance measures including token rotation and TLS configurations - Conduct disaster recovery tests to validate replication and failover strategies across clusters - Collaborate with governance teams to ensure compliance with data retention, anonymization, and privacy standards - Support continuous improvement initiatives by evaluating ingestion efficiency and exploring automation possibilities - Lead knowledge-sharing sessions and technical handoffs with Operations regarding new features or pipelines