{"schemaVersion":"jobsearcher.job.v1","id":"ea456c2117fe83661f6a0fcb","url":"https://jobsearcher.com/jobs/ea456c2117fe83661f6a0fcb","canonicalUrl":"https://jobsearcher.com/jobs/ea456c2117fe83661f6a0fcb","title":"Cribl Engineer","description":"Overview\nGovCIO is hiring a Cribl Engineer to support our Administrative Office of the US Courts NLS project. The NLS ingests an average of 18-20TB of logging data daily across 60 indexers distributed in 2 data centers. This position is located within the United States and is fully remote.\n\nResponsibilities\n\nDevelop and apply best practices and tools for data ingestion, indexing, and management to optimize data sources and refine data collection processes to capture only pertinent data.\n\nPlan and perform Cribl platform upgrades (Leader, Worker, and Edge nodes) following defined change control procedures.\n\nManage and optimize the Cribl distributed infrastructure, ensuring scalability, stability, and efficient data routing.\n\nContinuously monitor Cribl performance, including throughput, queue depth, and worker health metrics.\n\nDevelop and maintain Cribl pipelines for new data sources, implementing filtering, sampling, and enrichment logic.\n\nMigrate existing Splunk forwarder-based data inputs to Cribl for improved control and flexibility.\n\nBuild and maintain Cribl Packs for standardized configurations across multiple environments.\n\nImplement data reduction and enhancement workflows to minimize ingestion volume and improve data quality.\n\nMaintain and enhance Ansible playbooks for automated deployments, configurations, and upgrades.\n\nIntegrate GitOps CI/CD pipelines (e.g., GitLab, Jenkins, Terraform) to manage configuration‑as‑code for both Splunk and Cribl.\n\nDevelop, test, and review merge requests related to dashboards, alerts, saved searches, and data onboarding pipelines.\n\nPerform Splunk core upgrades (indexers, search heads, cluster masters, deployers) ensuring backward compatibility and minimal downtime.\n\nUpgrade and validate Splunk Add‑ons and Apps, maintaining functionality and CIM compliance.\n\nDevelop and maintain custom props, transforms, eventtypes, and lookups to normalize data consistently.\n\nEnsure CIM compliance for all add‑ons and sourcetypes used across the platform.\n\nHandle escalations from Operations and perform deep‑dive troubleshooting on ingestion, parsing, or performance issues.\n\nPerform break/fix analysis on Splunk core services such as KVStore, clustering, deployment server, and scheduler.\n\nConduct performance tuning for search optimization, bucket management, and scheduler balancing across SHC.\n\nDesign and maintain retention, archival, and index management strategies to align with business and compliance goals.\n\nManage license allocation, volume forecasting, and capacity planning across indexer clusters.\n\nDevelop and maintain monitoring and alerting integrations for Cribl and Splunk infrastructure health.\n\nCollaborate with Operations on incident triage, root cause analysis, and postmortem documentation.\n\nCreate and maintain runbooks and engineering guides for deployments, upgrades, and troubleshooting.\n\nParticipate in architecture and design discussions to ensure Splunk and Cribl meet enterprise scaling and reliability needs.\n\nImplement security and compliance controls including token rotation, TLS configurations, and secret management via Vault or GCP Secret Manager.\n\nPerform disaster recovery testing and validate replication and failover processes across clusters.\n\nCollaborate with governance teams to align on data retention, anonymization, and privacy requirements.\n\nSupport continuous improvement by analyzing ingestion efficiency, performance benchmarks, and automation opportunities.\n\nLead knowledge‑sharing sessions and technical handoffs with Operations for newly deployed features or pipelines.\n\nQualifications\nBachelor's degree with 8+ years of relevant experience (or commensurate experience).\n\nRequired Skills and Experience\n\n3 years of experience with the Cribl data engine.\n\nUnderstanding of data from a security perspective.\n\nPreferred Skills and Experience\n\nCribl Admin Certification.\n\nExperience in a Splunk environment.\n\nCloud experience.\n\nClearance Required\nMust be able to attain and maintain AOUSC Public Trust.\n\nPosted Salary Range\nUSD $105,000.00 – $145,000.00 per year.\n\nWe are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, disability, or status as a protected veteran. EOE, including disability/vets.\n\n#J-18808-Ljbffr","company":"GovCIO","rawCompany":"govcio","city":"Springfield","state":"IL","isRemote":false,"isActive":false,"createdAt":"2026-07-01T03:23:36.494Z","occupations":[{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"},{"code":"15-1244.00","title":"Network and Computer Systems Administrators","slug":"network-and-computer-systems-administrators"},{"code":"15-1243.01","title":"Data Warehousing Specialists","slug":"data-warehousing-specialists"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"},{"code":"518210","title":"Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services","slug":"computing-infrastructure-providers-data-processing-web-hosting-and-related-services"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Cribl Engineer","description":"Overview\nGovCIO is hiring a Cribl Engineer to support our Administrative Office of the US Courts NLS project. The NLS ingests an average of 18-20TB of logging data daily across 60 indexers distributed in 2 data centers. This position is located within the United States and is fully remote.\n\nResponsibilities\n\nDevelop and apply best practices and tools for data ingestion, indexing, and management to optimize data sources and refine data collection processes to capture only pertinent data.\n\nPlan and perform Cribl platform upgrades (Leader, Worker, and Edge nodes) following defined change control procedures.\n\nManage and optimize the Cribl distributed infrastructure, ensuring scalability, stability, and efficient data routing.\n\nContinuously monitor Cribl performance, including throughput, queue depth, and worker health metrics.\n\nDevelop and maintain Cribl pipelines for new data sources, implementing filtering, sampling, and enrichment logic.\n\nMigrate existing Splunk forwarder-based data inputs to Cribl for improved control and flexibility.\n\nBuild and maintain Cribl Packs for standardized configurations across multiple environments.\n\nImplement data reduction and enhancement workflows to minimize ingestion volume and improve data quality.\n\nMaintain and enhance Ansible playbooks for automated deployments, configurations, and upgrades.\n\nIntegrate GitOps CI/CD pipelines (e.g., GitLab, Jenkins, Terraform) to manage configuration‑as‑code for both Splunk and Cribl.\n\nDevelop, test, and review merge requests related to dashboards, alerts, saved searches, and data onboarding pipelines.\n\nPerform Splunk core upgrades (indexers, search heads, cluster masters, deployers) ensuring backward compatibility and minimal downtime.\n\nUpgrade and validate Splunk Add‑ons and Apps, maintaining functionality and CIM compliance.\n\nDevelop and maintain custom props, transforms, eventtypes, and lookups to normalize data consistently.\n\nEnsure CIM compliance for all add‑ons and sourcetypes used across the platform.\n\nHandle escalations from Operations and perform deep‑dive troubleshooting on ingestion, parsing, or performance issues.\n\nPerform break/fix analysis on Splunk core services such as KVStore, clustering, deployment server, and scheduler.\n\nConduct performance tuning for search optimization, bucket management, and scheduler balancing across SHC.\n\nDesign and maintain retention, archival, and index management strategies to align with business and compliance goals.\n\nManage license allocation, volume forecasting, and capacity planning across indexer clusters.\n\nDevelop and maintain monitoring and alerting integrations for Cribl and Splunk infrastructure health.\n\nCollaborate with Operations on incident triage, root cause analysis, and postmortem documentation.\n\nCreate and maintain runbooks and engineering guides for deployments, upgrades, and troubleshooting.\n\nParticipate in architecture and design discussions to ensure Splunk and Cribl meet enterprise scaling and reliability needs.\n\nImplement security and compliance controls including token rotation, TLS configurations, and secret management via Vault or GCP Secret Manager.\n\nPerform disaster recovery testing and validate replication and failover processes across clusters.\n\nCollaborate with governance teams to align on data retention, anonymization, and privacy requirements.\n\nSupport continuous improvement by analyzing ingestion efficiency, performance benchmarks, and automation opportunities.\n\nLead knowledge‑sharing sessions and technical handoffs with Operations for newly deployed features or pipelines.\n\nQualifications\nBachelor's degree with 8+ years of relevant experience (or commensurate experience).\n\nRequired Skills and Experience\n\n3 years of experience with the Cribl data engine.\n\nUnderstanding of data from a security perspective.\n\nPreferred Skills and Experience\n\nCribl Admin Certification.\n\nExperience in a Splunk environment.\n\nCloud experience.\n\nClearance Required\nMust be able to attain and maintain AOUSC Public Trust.\n\nPosted Salary Range\nUSD $105,000.00 – $145,000.00 per year.\n\nWe are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, disability, or status as a protected veteran. EOE, including disability/vets.\n\n#J-18808-Ljbffr","datePosted":"2026-07-01T03:23:36.494Z","dateModified":"2026-07-01T03:23:36.494Z","hiringOrganization":{"@type":"Organization","name":"GovCIO","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Springfield","addressRegion":"IL","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"ea456c2117fe83661f6a0fcb"},"url":"https://jobsearcher.com/jobs/ea456c2117fe83661f6a0fcb"}}