Qualcomm Intl Inc., Mexico Branch Office
Information Technology Group, Information Technology Group > IT Engineering
General Summary:
General Summary
This role joins the Qualcomm IT Operations Management and Analytics (ITOMA) team, responsible for managing the global Splunk and Cribl infrastructure across the enterprise.
You will serve as a Splunk platform engineer, supporting the day-to-day administration, health, performance, and upgrade lifecycle of a large-scale, distributed Splunk environment — including search head clusters, indexer clusters, deployment servers, and heavy/universal forwarder fleets. Keeping this infrastructure stable, performant, and current is a foundational expectation of this role.
You will also contribute to a strategic initiative: migrating Qualcomm's security operations (SIEM), while helping maintain and optimize the broader observability data pipeline. Data routing and ingestion will leverage a hybrid approach using Cribl Stream/Edge, Azure Monitor Agent (AMA), and native Sentinel integrations — and you'll support the design, implementation, and operation of these flows at enterprise scale.
Beyond the SIEM migration, you will support data pipelining across the full lifecycle — collection, transformation, routing, filtering, enrichment, and delivery — helping ensure the right data reaches the right platform (Splunk, Sentinel, Datadog, ADX) based on use case, cost, and retention requirements. You will also help evaluate and adopt OpenTelemetry (OTEL) as part of Qualcomm's longer-term strategy to standardize telemetry collection across open, vendor-neutral frameworks.
This is a multi-disciplinary role that works with Security, IT, Engineering, and EDA (Electronic Design Automation) teams — whose chip design environments generate some of the highest telemetry volumes in the enterprise — to support solutions, onboard data sources, and help enforce data governance standards.
Shape
Principal Duties and Responsibilities
Splunk Administration & Platform Management
Administer and support a large-scale, distributed Splunk environment — including search head clusters (SHC), indexer clusters (IDXC), deployment servers, license masters, monitoring consoles, and heavy/universal forwarder fleets.
Support Splunk version upgrades across multiple tiers (search heads, indexers, forwarders, deployment server) — assisting with compatibility validation, app certification checks, rolling upgrade execution, and post-upgrade testing.
Monitor Splunk cluster health — replication/search factor compliance, bucket integrity, indexer performance, search concurrency, scheduler efficiency, and KV Store stability.
Track Splunk licensing — monitor daily ingestion volumes, identify usage trends, investigate license violations, and help implement controls to prevent overages.
Support capacity planning efforts — helping forecast storage, compute, and indexing needs based on data growth trends and onboarding projections.
Administer index management — index creation, retention policies, data tiering (hot/warm/cold/frozen), and SmartStore configuration where applicable.
Create and manage knowledge objects — field extractions, macros, event types, tags, lookups, data models, and saved searches — ensuring consistency and reusability across the platform.
Develop Splunk applications, dashboards, and visualizations to support operational and security use cases.
Help maintain role-based access controls (RBAC), authentication integrations (SAML/LDAP), and audit compliance for the Splunk environment.
Provide Tier 3 on-call support for Splunk and Cribl platform issues — including incident response for platform outages, ingestion failures, and search performance degradation.
Maintain and update operational runbooks and documentation for Splunk administrative procedures, upgrade playbooks, and recovery processes.
Data Pipeline Engineering & Operations
Build and maintain data pipelines using Cribl Stream/Edge, Splunk forwarders, Azure Monitor Agent (AMA), and observability pipeline frameworks to ingest, transform, filter, and route logs, metrics, and events.
Develop and manage Cribl pipelines — sources, transforms, routes, and destinations — to support scalable log and metric processing across multiple output platforms.
Support data routing strategies across Splunk, Microsoft Sentinel, Datadog, and Azure Data Explorer (ADX), ensuring data delivery aligns with use case, cost, and retention requirements.
Optimize ingestion pipelines to reduce unnecessary data volume through filtering, sampling, aggregation, and transformation — helping drive cost efficiency without compromising observability or security coverage.
Troubleshoot and resolve data ingestion and pipeline issues across distributed systems, including forwarders, collectors, agents, and pipeline infrastructure.
Sentinel Migration & Security Data Flows
Contribute to the SIEM migration, helping build data flows that route security-relevant telemetry to Sentinel via Cribl, AMA, and native connectors.
Work with the Security team to ensure detection, compliance, and incident response data requirements are met throughout the migration.
Help validate and optimize data routing rules to avoid duplicate ingestion costs across legacy (Splunk) and target (Sentinel) platforms during the migration period.
Data Governance & Standards
Help maintain standards for telemetry data pipelines — naming conventions, tagging, data classification, and lifecycle management.
Collaborate with application teams and platform owners to onboard new data sources, ensuring alignment with enterprise logging standards, schema expectations, and governance policies.
Improve data quality through enrichment, cleansing, and catalog management.
Innovation & Modernization
Help evaluate and test emerging pipeline technologies — including OpenTelemetry (OTEL), vectorized pipelines, and cloud-native ingestion services — as part of the broader observability and data platform strategy.
Identify opportunities for automation across data ingestion, routing, and platform administration workflows.
Write clear technical documentation for pipeline architectures and operational procedures.
Shape
Technologies
Area
Tools
Splunk Platform
Splunk Enterprise (SHC, IDXC, Deployment Server, License Master, Monitoring Console), SmartStore
Data Pipelining
Cribl Stream, Cribl Edge, Azure Monitor Agent (AMA), OpenTelemetry
SIEM / Observability
Splunk, Microsoft Sentinel, Datadog, Azure Data Explorer (ADX)
Languages
Python, Perl, JavaScript, Bash
Cloud
AWS, Microsoft Azure
Deployment / CI-CD
Jenkins, Git/GitHub, Docker
OS
Linux/UNIX
Required Qualifications
BS degree in Computer Science or related technical field, or equivalent practical experience.
3+ years of experience in Splunk administration and/or data engineering in enterprise environments.
Experience supporting distributed Splunk deployments — including search head clusters, indexer clusters, deployment servers, and forwarder management.
Experience participating in Splunk version upgrades across clustered environments.
Proficiency in Splunk administration — including knowledge object creation, index management, retention policies, and search optimization.
Experience with Cribl (Stream and/or Edge) or similar data pipeline/routing technologies.
Experience with data pipelines for logs, metrics, and events across multiple destination platforms.
Experience with log routing, filtering, enrichment, and cost optimization strategies (e.g., reducing duplicate ingestion, sampling, aggregation).
Proficiency in Python and/or Perl scripting for automation and pipeline development.
Linux/UNIX systems experience.
Familiarity with cloud platforms (AWS and/or Azure).
Strong communication skills — ability to convey technical issues to diverse audiences clearly.
Ability to work with global teams across time zones.
Preferred Qualifications
Splunk Enterprise Certified Admin or Splunk Architect certification.
Experience with Splunk SmartStore, including S3/Azure Blob integration for tiered storage.
Experience with Microsoft Sentinel — including data connectors, AMA configuration, and Log Analytics workspace management.
Hands-on experience with OpenTelemetry (OTEL) — collectors, instrumentation, and integration with observability backends.
Experience with Azure Data Explorer (ADX) or Kusto Query Language (KQL).
Splunk application and dashboard development.
AWS and/or Azure certifications.
Experience in security log management or SIEM operations.
Minimum Qualifications:
- 3+ years of IT-related work experience with a Bachelor's degree.
OR
5+ years of IT-related work experience without a Bachelor’s degree.
Applicants : Qualcomm is an equal opportunity employer. If you are an individual with a disability and need an accommodation during the application/hiring process, rest assured that Qualcomm is committed to providing an accessible process. You may e-mail [email protected] or call Qualcomm's toll-free number found here . Upon request, Qualcomm will provide reasonable accommodations to support individuals with disabilities to be able participate in the hiring process. Qualcomm is also committed to making our workplace accessible for individuals with disabilities. (Keep in mind that this email address is used to provide reasonable accommodations for individuals with disabilities. We will not respond here to requests for updates on applications or resume inquiries).
Qualcomm expects its employees to abide by all applicable policies and procedures, including but not limited to security and other requirements regarding protection of Company confidential information and other confidential and/or proprietary information, to the extent those requirements are permissible under applicable law.
To all Staffing and Recruiting Agencies : Our Careers Site is only for individuals seeking a job at Qualcomm. Staffing and recruiting agencies and individuals being represented by an agency are not authorized to use this site or to submit profiles, applications or resumes, and any such submissions will be considered unsolicited. Qualcomm does not accept unsolicited resumes or applications from agencies. Please do not forward resumes to our jobs alias, Qualcomm employees or any other company location. Qualcomm is not responsible for any fees related to unsolicited resumes/applications.
If you would like more information about this role, please contact Qualcomm Careers .
