Kowsalya

• Led the deployment and management of Splunk Enterprise and Splunk Cloud to monitor and analyse logs and metrics from on-premises and cloud-based infrastructure, improving system observability across multiple environments.
• Administer and support enterprise Splunk environments for security monitoring and application observability across hybrid environments.
• Design and implement log onboarding solutions for applications, servers, infrastructure components, and cloud-based workloads.
• Configure and maintain data ingestion pipelines to ensure reliable collection, indexing, and availability of security and operational logs.
• Develop SPL searches, dashboards, reports, and alerts to support security monitoring and operational visibility.
• Implement security monitoring use cases by analyzing requirements and translating them into effective searches, alerts, and dashboards.
• Support SOC teams by improving log visibility, validating data availability, troubleshooting ingestion issues, and tuning alerts.
• Manage Splunk platform administration activities including installation, configuration, upgrades, patching, health checks, and troubleshooting.
• Support Splunk clustered environments including Search Head Cluster, Indexer Cluster, Deployment Server, and License Management.
• Implement OpenTelemetry Collector for centralized collection of logs, metrics, and distributed traces.
• Perform performance tuning activities including search optimization, ingestion troubleshooting, and platform health monitoring.

Company Overview: Client - UK-based leading bank.

• Supported SIEM operations and security monitoring activities for enterprise banking applications.
• Worked closely with SOC teams to improve security visibility and monitoring capabilities.
• Performed log analysis and event investigation to support security incidents and operational issues.
• Onboarded application, server, database, middleware, and infrastructure logs into Splunk.
• Developed SPL searches, dashboards, reports, and alerts based on security and monitoring requirements.
• Supported security use case implementation through event correlation and alert configuration.
• Assisted SOC teams during incident investigations by validating log availability and analyzing security events.
• Troubleshot log ingestion issues, missing events, parsing issues, and data availability problems.
• Collaborated with security and application teams for new application onboarding and monitoring enhancements.
• Supported security configuration activities related to enterprise authentication and access management platforms.

• Company Overview: Client - UK-based leading bank.
• Implemented log forwarding architecture using Splunk Universal Forwarders,and configured heavy forwarders for high-volume data transfer.
• Administered the Splunk environment for enterprise-wide log management and monitoring, supporting the integration of multiple data sources, such as servers, applications, and network devices.
• Troubleshot and resolved performance issues within Splunk instances, including search slowdowns, indexing problems, and configuration conflicts.
• Managed data retention policies and automated index rotation to optimize disk space usage, and ensure compliance with data retention standards.
• Integrated Splunk with third-party tools to collect the logs to monitor, and implemented a ticketing tool such as ServiceNow for automated ticket creation based on critical events and incidents.
• Developed specific content necessary to implement security use cases and transform it into correlation queries, templates, reports, rules, alerts, dashboards, and workflows.