Splunk Enterprise/Splunk SOAR Architect

Continuing my path as Splunk administrator at Dell, I have been also working
with Splunk SOAR (Phantom) as Architect and Application Owner, responsible
for building up the whole environment and customizing it to fit our needs at
Dell. Currently offering SOAR for several internal teams with 300+ active
playbooks and automations for automatic remediation/investigation along with
partnership on the security orchestration part of Phantom at Dell. In addition to
that, being responsible for the API integration part from Splunk with Dell Digital
Cloud to offer our users a frictionless request way to get monitors deployed,
and providing consultancy for other internal teams to develop the same level of
integration.

As Splunk administrator, I work with Splunk deployment across our
infrastructure to collect the data, managing data filtering and complex
extraction to transform raw logs into structured data by extracting complex
fields from different types of log files using Regular Expressions.
As part of innovation, working also with automation of tasks and features by
using the native API structure, Control-M and Bladelogic Server Automation
jobs running custom scripts to either proactively identify situations that could
harm us and fix them before that or remediate unexpected events in a 24/7
schedule. I'm also the currently SME of integration with external apps such
as ServiceNow, enabling Splunk ability to transform events into events in the
ITSM tool.
Monitor and track Splunk performance problems along with the customer and
interfacing recurring sessions with the vendor.
Started in 2019 to work with Splunk Phantom SOAR tool, becoming the
technical owner and currently certified as Phantom Administrator by Splunk.

Responsible for the second level of support (L2 analyst) for IT division of
Dell Technologies company, providing 24x7 coverage through assigned
shifts and on-call rotations. Supporting critical production applications and
working closely with Development, Automation and Testing Teams, as well as
various shared services groups (vendors) in order to maintain our portfolio of
enterprise applications and their correlated working properly during all days
and nights.
In the principal accountabilities, I would highlight the Ticket Management
to analysis and prevention of root cause, Crisis Management during crisis
conditions/bridge conferences, Knowledge Management developing and
documenting of key support aspects, Customer Interface interacting regularly
with global team members and Change Management for the launch of new
code into production during the scheduled maintenance windows.
I would also point it out the daily contact with technologies such as Microsoft
Visual Studio Team Foundation Server (TFS), Microsoft System Center
Operations Manager (SCOM) Servers and System Center Configuration
Manager (SCCM), Oracle Enterprise Manager (OEM12c), BMC Control-M
jobs scheduling routine/servers, Unix-based OS and third-party monitoring,
management and data-related applications, ServiceNow ticket/event
management.