Location: London, UK (Hybrid - 3 days in a week from client office)
Role Purpose
We need someone who can independently improve our DLP monitoring and alerting capability across Splunk and the wider DLP toolset.
Strong hands-on Splunk engineering experience, including advanced SPL, multi-index correlation, drilldowns, dashboards and alert development.
Practical experience with DLP related indexes
Able to take multiple DLP data sources and build joined views of user activity, incidents and control outcomes.
Experienced in tuning detection logic, reducing false positives and converting high-volume monitoring data into targeted, actionable alerts.
Able to build operational and management reporting, with clear documentation and runbooks for the internal team.
Comfortable working independently with junior analysts and transferring knowledge as the capability is developed.
Expected outcomes would include improved DLP dashboards, refined alerts and correlation use cases, documented searches and processes, and a sustainable reporting approach.
We use essential cookies to make this site work. With your permission we would also like to use the optional cookies below. Nothing optional is set until you choose, and you can change your mind at any time from "Cookie settings" at the bottom of every page. Cookie policy.
Essential — keep the site working and secure, and remember the choice you make here. Always on.