Software Engineer II - Splunk/CRIBL

 

You are ready to help shape how teams see, understand, and improve production systems. Joining us means working on the monitoring and telemetry foundation that enables faster incident response, clearer operational insights, and better customer experiences. You will collaborate with engineers and platform partners while growing your skills in observability engineering and automation.

As a Software Engineer II at JPMorganChase within Enterprise Platforms, you will administer and enhance our monitoring stack, focusing on Splunk and Cribl configurations, data pipelines, and telemetry quality. You will help ensure logs, metrics, and events flow reliably across environments, and you will contribute to building repeatable, automated approaches that scale.

 

Job responsibilities

• Administer and maintain Splunk configurations across environments, including indexes, sourcetypes, inputs, and props/transforms
• Build and optimize SPL searches, alerts, dashboards, and reports to support incident response and operational insights
• Support the Splunk app and technology add-on lifecycle, including installation, upgrades, configuration, and user access management
• Configure and manage Cribl Stream and/or Edge, including routes, pipelines, workers, and sources/destinations (for example, syslog, HTTP, Amazon S3, Splunk, and Kafka)
• Implement parsing, enrichment, redaction, sampling, and suppression logic, and validate pipelines through testing and previewing outputs
• Manage Cribl Packs, versioning, and promotions across environments, leveraging Git-based configuration workflows
• Optimize telemetry data flow for cost and performance using filtering, routing-by-criteria, event shaping, and load balancing
• Onboard new data sources end-to-end with documentation, standards, and appropriate access controls
• Implement data quality controls such as field extraction standards, normalization approaches, schema alignment, and sensitive data redaction
• Automate configuration deployment and validation using scripts and continuous integration/continuous delivery practices where applicable
• Participate in incident triage and ingestion troubleshooting and contribute to an on-call rotation with support from senior engineers

 

Required qualifications, capabilities and skills

• Formal training or certification on software engineering concepts and 2+ years applied experience
• 4+ years of software engineering, site reliability engineering, or DevOps applied experience
• Experience supporting Splunk fundamentals, including indexes, sourcetypes, inputs, props/transforms, and SPL for searches, alerts, and dashboards
• Experience supporting Cribl Stream and/or Edge concepts, including sources, destinations, routes, pipelines, functions, and Packs
• Experience with scripting or automation using Python, Bash, or PowerShell
• Working knowledge of Linux and Git-based workflows
• Understanding of logging and metrics fundamentals, including structured logging, log levels, cardinality, sampling, retention, and backpressure
• Strong problem-solving skills, attention to detail, and ability to learn and operate effectively in production environments

 

Preferred qualifications, capabilities and skills

• Experience with Splunk advanced capabilities such as scheduled searches, macros, lookups, KV store, performance tuning, and deployment operations
• Experience designing Cribl pipelines using functions such as parsing, evaluation, redaction, serialization, sampling, suppression, and regular expression-based extraction
• Experience integrating common observability sources and destinations such as syslog, Windows Event Forwarding, Fluent Bit, Kafka, Amazon S3, Splunk HTTP Event Collector, Elastic, or Datadog
• Exposure to additional observability tools such as Grafana or Elastic
• Experience with continuous integration/continuous delivery for observability assets and configuration-as-code with automated validation
• Basic networking and security knowledge, including TLS, certificates, proxies, firewalls, HTTP headers, and authentication patterns