Principal Security Technical Architect

Make an impact with NTT DATA
Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations and for making a difference to our clients and society. Our workplace embraces diversity and inclusion its a place where you can grow belong and thrive.

The role requires leading and executing enterprise-scale SIEM assessments and transformation initiatives with a strong focus on Splunk-based security platforms. The candidate will be responsible for conducting deep-dive technical evaluations defining target-state architectures and driving remediation and optimization strategies across the SIEM landscape.

Key responsibilities include:

• Lead and deliver end-to-end SIEM platform assessments evaluating current-state architecture maturity scalability and operational effectiveness of Splunk environments
• Perform detailed technical validation of existing artifacts including architecture diagrams data flow models ingestion pipelines and operational runbooks
• Assess security control effectiveness identify architectural and operational gaps and define actionable risk-aligned remediation strategies
• Own the creation of architect-level deliverables ensuring alignment with enterprise standards governance frameworks and long-term maintainability
• Partner with Security Assurance and Governance teams to define and integrate operational and technical requirements into ongoing and future initiatives
• Drive and enforce Common Information Model (CIM) compliance ensuring data onboarding aligns with Splunk Enterprise Security requirements and detection frameworks

Execute structured SIEM assessments across the following domains:

• Evaluate Splunk topology (forwarders indexers search heads clustered deployments) with focus on high availability fault tolerance and horizontal scalability
• Assess performance tuning indexing throughput search optimization and data retention strategies
• Validate platform health monitoring observability and integration with external systems (e.g. ITSM / ServiceNow Security Incident Response)

• Analyze data onboarding lifecycle including prioritization ingestion pipelines parsing normalization and enrichment
• Evaluate data quality timestamp accuracy event breaking and CIM alignment
• Assess license consumption patterns filtering strategies and ingestion optimization frameworks

• Evaluate use case intake prioritization and lifecycle management
• Review detection engineering practices including correlation searches detection-as-code models and ES content alignment
• Assess coverage maturity against business risks and threat scenarios

• Evaluate SIEM governance frameworks policies standards and compliance alignment
• Assess operating models RACI structures stakeholder engagement mechanisms and training enablement programs
• Review effectiveness of working groups review boards and continuous improvement processes

• Mandatory Certification: Active Splunk Enterprise Certified Architect (Administrator certification alone is insufficient for this role)
• Experience:
  • 10 years overall experience in Security / SIEM / Observability
  • Minimum 5 years of hands-on experience with Splunk Enterprise Security (ES) in large-scale enterprise environments
• Proven experience in leading SIEM assessments transformation programs and architectural reviews leveraging Splunk platforms
• Deep expertise in Splunk architecture design including:
  • Indexer clustering search head clustering deployment strategies
  • High availability design disaster recovery and capacity planning
  • Performance tuning and large-scale data handling
• Advanced hands-on expertise in data onboarding and ingestion engineering including:
  • Complex parsing and transformation ( / )
  • Data routing filtering enrichment and pipeline optimization
  • Implementation and validation of CIM-compliant data models
• Demonstrated ability to design and build complex customer-specific Splunk applications aligned to real-world use cases (e.g. SOC operations fraud analytics operational intelligence) beyond basic dashboards and reporting
• Strong capability in independent troubleshooting of Splunk infrastructure including:
  • Ingestion delays parsing issues cluster inconsistencies search performance bottlenecks
  • Root cause analysis using internal logs and metrics
  • Ability to resolve issues without heavy reliance on vendor support
• Proven track record in delivering Architect-level outputs including:
  • High-Level Design (HLD) and Low-Level Design (LLD)
  • Detailed architecture and data flow diagrams
  • SIEM assessment reports and maturity models
  • Data onboarding standards governance frameworks and optimization strategies
  • Remediation roadmaps and performance improvement plans
• Strong understanding and applied expertise of Replication Factor and Search Factor with hands-on experience in clustered environments
• Excellent stakeholder management communication and leadership skills with the ability to:
  • Lead cross-functional teams and advisory engagements
  • Engage with senior stakeholders (CISO EA Security Leads)
  • Drive technical decision-making and governance alignment

Workplace type:

About NTT DATA
NTT DATA is a $30 billion business and technology services leader serving 75% of the Fortune

Global 100. We are committed to accelerating client success and positively impacting society through

responsible innovation. We are one of the worlds leading AI and digital infrastructure providers with

unmatched capabilities in enterprise-scale AI cloud security connectivity data centers and

application services. Our consulting and industry solutions help organizations and society move

confidently and sustainably into the digital future. As a Global Top Employer we have experts in more

than 70 countries. We also offer clients access to a robust ecosystem of innovation centers as well as

established and start-up partners. NTT DATA is part of NTT Group which invests over $3 billion each

year in R&D.

Equal Opportunity Employer
NTT DATA is proud to be an Equal Opportunity Employer with a global culture that embraces diversity. We are committed to providing an environment free of unfair discrimination and harassment. We do not discriminate based on age race colour gender sexual orientation religion nationality disability pregnancy marital status veteran status or any other protected category. Join our growing global team and accelerate your career with us. Apply today.

Third parties fraudulently posing as NTT DATA recruiters

NTT DATA recruiters will never ask job seekers or candidates for payment or banking information during the recruitment process for any reason. Please remain vigilant of third parties who may attempt to impersonate NTT DATA recruiters whether in writing or by phone in order to deceptively obtain personal data or money from you. All email communications from an NTT DATA recruiter will come from an @ email address. If you suspect any fraudulent activity please contact us.