Data Pipeline & Platform Engineer, Observability & Security

## Company: Qualcomm Intl Inc., Mexico Branch Office ## Job Area: Information Technology Group, Information Technology Group > IT Engineering General Summary: General Summary This role joins the Qualcomm IT Operations Management and Analytics (ITOMA) team, responsible for managing the global Splunk and Cribl infrastructure across the enterprise. You will serve as a Splunk platform engineer, supporting the day-to-day administration, health, performance, and upgrade lifecycle of a large-scale, distributed Splunk environment — including search head clusters, indexer clusters, deployment servers, and heavy/universal forwarder fleets. Keeping this infrastructure stable, performant, and current is a foundational expectation of this role. You will also contribute to a strategic initiative: migrating Qualcomm's security operations (SIEM), while helping maintain and optimize the broader observability data pipeline. Data routing and ingestion will leverage a hybrid approach using Cribl Stream/Edge, Azure Monitor Agent (AMA), and native Sentinel integrations — and you'll support the design, implementation, and operation of these flows at enterprise scale. Beyond the SIEM migration, you will support data pipelining across the full lifecycle — collection, transformation, routing, filtering, enrichment, and delivery — helping ensure the right data reaches the right platform (Splunk, Sentinel, Datadog, ADX) based on use case, cost, and retention requirements. You will also help evaluate and adopt OpenTelemetry (OTEL) as part of Qualcomm's longer-term strategy to standardize telemetry collection across open, vendor-neutral frameworks. This is a multi-disciplinary role that works with Security, IT, Engineering, and EDA (Electronic Design Automation) teams — whose chip design environments generate some of the highest telemetry volumes in the enterprise — to support solutions, onboard data sources, and help enforce data governance standards. Shape Principal Duties and Responsibilities Splunk Administration & Platform Management Administer and support a large-scale, distributed Splunk environment — including search head clusters (SHC), indexer clusters (IDXC), deployment servers, license masters, monitoring consoles, and heavy/universal forwarder fleets. Support Splunk version upgrades across multiple tiers (search heads, indexers, forwarders, deployment server) — assisting with compatibility validation, app certification checks, rolling upgrade execution, and post-upgrade testing. Monitor Splunk cluster health — replication/search factor compliance, bucket integrity, indexer performance, search concurrency, scheduler efficiency, and KV Store stability. Track Splunk licensing — monitor daily ingestion volumes, identify usage trends, investigate license violations, and help implement controls to prevent overages. Support capacity planning efforts — helping forecast storage, compute, and indexing needs based on data growth trends and onboarding projections. Administer index management — index creation, retention policies, data tiering (hot/warm/cold/frozen), and SmartStore configuration where applicable. Create and manage knowledge objects — field extractions, macros, event types, tags, lookups, data models, and saved searches — ensuring consistency and reusability across the platform. Develop Splunk applications, dashboards, and visualizations to support operational and security use cases. Help maintain role-based access controls (RBAC), authentication integrations (SAML/LDAP), and audit compliance for the Splunk environment. Provide Tier 3 on-call support for Splunk and Cribl platform issues — including incident response for platform outages, ingestion failures, and search performance degradation. Maintain and update operational runbooks and documentation for Splunk administrative procedures, upgrade playbooks, and recovery processes. Data Pipeline Engineering & Operations Build and maintain data...