# Security Consulting Architect for SOC Transformation & Splunk

**Company**: Cisco
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://cisco.wd5.myworkdayjobs.com/en-US/Cisco_Careers/job/Pune-India/Customer-Delivery-Architect---10--years--SOC-transformation_2024367?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_62e2b6ee-34e

## Description

Cisco Customer Experience (CX) Security Services is a global team of elite security practitioners, architects, and trusted advisors who help large enterprise and service provider customers defend against sophisticated threats, achieve operational cyber resilience, and accelerate digital transformation.

As a Security Consulting Architect for SOC Transformation & Splunk, you will be the chief technical authority and visionary guiding enterprise customers through complex SOC modernization journeys. You will translate customer business outcomes, risk profiles, and operational strategies into scalable, high-fidelity security architectures powered by Splunk Cloud, Splunk Enterprise Security (ES), Splunk SOAR, User & Entity Behavior Analytics (UEBA), Cribl Stream, and modern object storage (MinIO).

Key responsibilities:

- Lead the architectural design, Target Operating Model (TOM), and delivery strategy for multi-tier enterprise SOCs, SIEM modernizations, and security automation frameworks aligned with MITRE ATT&CK and Cisco Validated Designs.

- Architect enterprise-scale Splunk Cloud deployments; design Risk-Based Alerting (RBA) frameworks, Data Model Acceleration (DMA) strategies, optimized search pipelines, Asset & Identity (A&I) contextual enrichment, and ESCU detection updates to eliminate alert fatigue.

- Architect high-throughput, resilient security data collection pipelines leveraging Cribl Stream for edge transformation, filtering, and routing, combined with MinIO / S3-compatible object storage for high-performance SmartStore tiering and compliance data archiving.

- Define incident triage and response workflows, designing modular, production-grade Python playbooks in Splunk SOAR for automated threat enrichment, endpoint containment, firewall mitigation, and bidirectional ITSM synchronization.

- Provide technical direction, architectural governance, and mentorship to specialized engineering execution pods.

Minimum qualifications:

- 10+ years of technical cybersecurity engineering and architecture experience designing and deploying enterprise Security Operations Center (SOC) environments and SIEM/SOAR platforms.

- 5+ years of dedicated, hands-on architecture and engineering experience with Splunk Enterprise, Splunk Cloud, and Splunk Enterprise Security (ES).

- 3+ years of hands-on experience in security telemetry pipeline engineering, including log routing and normalization with Cribl Stream, data parsing, and object storage/SmartStore tiering with MinIO or S3-compatible cloud storage.

- 3+ years of security orchestration and automation experience designing and building automated response playbooks using Splunk SOAR and Python.

- Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical industry engineering experience.

Preferred qualifications:

- Splunk & Pipeline Certifications: Splunk Enterprise Certified Architect, Splunk Enterprise Security Certified Admin, Splunk SOAR Certified Automation Developer, or Cribl Certified Observability Engineer (CCOE).

- Industry Security Credentials: CISSP, CCIE Security, CISM, or GIAC certifications.

- Advanced Behavioral Analytics & Threat Modeling: Practical experience deploying Splunk UEBA, implementing machine learning models for anomaly detection, and conducting atomic detection testing against the MITRE ATT&CK matrix.

- Executive Advisory & Technical Consulting: Exceptional C-suite consulting, presentation, and technical leadership skills with a proven track record of advising CISOs, leading technical workshops, and driving organizational change.

- Hybrid Cloud & Multi-Vendor Ecosystem Integration: Deep knowledge of multi-cloud security logging, Next-Gen Firewalls, EDR platforms, and Cisco Security Cloud integrations.

## Skills

### Required
- Splunk Enterprise
- Splunk Cloud
- Splunk Enterprise Security (ES)
- Cribl Stream
- MinIO
- Splunk SOAR
- Python
- MITRE ATT&CK
- Cisco Validated Designs
- Risk-Based Alerting (RBA)
- Data Model Acceleration (DMA)
- User & Entity Behavior Analytics (UEBA)
- Security Orchestration
- Automation
- Cybersecurity Engineering
- Architecture

### Nice to have
- Splunk Enterprise Certified Architect
- Splunk Enterprise Security Certified Admin
- Splunk SOAR Certified Automation Developer
- Cribl Certified Observability Engineer (CCOE)
- CISSP
- CCIE Security
- CISM
- GIAC certifications
- Splunk UEBA
- Machine Learning
- Anomaly Detection
- MITRE ATT&CK matrix
- Executive Advisory
- Technical Consulting
- C-suite consulting
- Presentation
- Technical Leadership
- Hybrid Cloud
- Multi-Vendor Ecosystem Integration

---

Source: [Apply at cisco.wd5.myworkdayjobs.com](https://cisco.wd5.myworkdayjobs.com/en-US/Cisco_Careers/job/Pune-India/Customer-Delivery-Architect---10--years--SOC-transformation_2024367?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)