Security Platform Engineer

Kelaru; Sydney; Hybrid; AUD 120,000 - 140,000; Full time

Benefits offered by this job

Hybrid work

Training & certs

Ownership of work

Large-scale environments

Job summary

Kelaru Recruitment is seeking a Security Platform Engineer to join the security engineering team for a major ASX-listed company in Sydney. The role combines hands-on Splunk work with AWS, CyberArk, and DevSecOps practices across on-prem and cloud environments.

The position offers hybrid work with remote and on-site time at the client’s Sydney offices. You will onboard data sources into Splunk, build logging and detection coverage, and contribute to PAM and automation efforts while growing across

Qualifications

• Hands-on Splunk in a production environment, data onboarding and ES exposure preferred.
• Solid Linux and Windows Server fundamentals.
• Networking basics: syslog, firewalls, DNS, connectivity troubleshooting.
• Some scripting ability (Python, Bash, PowerShell).
• Curious, methodical mindset with a drive to learn across security and cloud.

Responsibilities

• Onboard applications and data sources into Splunk, deploy forwarders and write transforms.
• Collaborate with application teams to ensure security visibility.
• Build and support Splunk Enterprise and Splunk ES across on‑prem and cloud.
• Contribute to CyberArk privileged access management onboarding and ops.
• Work with AWS services to integrate security tooling and cloud workloads.
• Automate builds and repetitive tasks using scripting, CI/CD and IaC.
• Troubleshoot across platforms and resolve issues with other teams.
• Deliver changes in production environments, with occasional out‑of‑hours windows.
• Document what you build for handover.

Skills

Splunk

Linux fundamentals

Windows Server basics

Networking basics

Scripting (Python, PowerShell)

Tools

Splunk Enterprise

CyberArk

AWS

Terraform

CI/CD

Job description

Security Platform Engineer | Sydney | Hybrid | $120K – $140K + Super

Kelaru Recruitment are hiring for a Security Platform Engineer to join the security engineering team at a major ASX-listed company.

The package

Full-time, permanent

$120,000 to $140,000 + super, depending on experience and fit

Hybrid: remote plus on‑site time at the client’s Sydney offices as required

Certification and training support across Splunk, AWS and CyberArk

About the client

Our client is a major ASX-listed company running enterprise-scale security platforms across on-premises and cloud, with a hands‑on engineering team behind them.

About the role

You’ll join their security engineering team, building and running the platforms that protect their environment. Splunk is where you’ll spend most of your time to start: onboarding new data sources and applications, building out logging and detection coverage, and helping uplift and scale the platform across on-premises and cloud. From there, the work extends into privileged access with CyberArk, AWS, and DevSecOps practices such as automation, CI/CD and infrastructure‑as‑code.

This role suits an early‑to‑mid career engineer who wants to grow across multiple platforms rather than sit in one tool. It’s also a good fit for more experienced engineers who want broader exposure, and for people taking their first step from a SOC or infrastructure role into engineering. You’ll work alongside senior engineers who will help you get there.

What you’ll be doing

• Onboarding applications and data sources into Splunk: deploying Universal and Heavy Forwarders, writing props and transforms, configuring Technology Add-ons (TAs) and normalising data to CIM
• Working with application teams to get the right security visibility in place
• Building, uplifting and supporting Splunk Enterprise and Splunk Enterprise Security across on‑premises and cloud
• Contributing to CyberArk privileged access management, including onboarding accounts and platforms and supporting day‑to‑day operations
• Working with AWS services to integrate security tooling, logging and cloud workloads
• Automating builds, configuration and repetitive tasks using scripting, CI/CD and infrastructure‑as‑code
• Troubleshooting issues across platforms, networks and integrations, and working with other teams to resolve them
• Delivering changes in production environments, with occasional out‑of‑hours change windows
• Documenting what you build so it can be handed over cleanly

What we’re looking for

• Hands‑on Splunk experience in a production environment, ideally including data onboarding (forwarders, props/transforms, TAs). Splunk ES exposure is a plus
• Solid Linux and Windows Server fundamentals
• Networking basics: syslog, firewalls, DNS and connectivity troubleshooting
• Some scripting ability (Python, Bash, PowerShell or similar)
• A curious, methodical mindset. You’d rather understand why something broke than just restart it

Nice to have (any of these help)

• CyberArk (PAM) experience or certification
• SailPoint (IGA) experience
• AWS experience or certifications
• Infrastructure‑as‑code and CI/CD (Terraform, CloudFormation, Ansible, Git pipelines)
• Splunk certifications (Power User, Admin, ES)
• Experience in enterprise environments

You don’t need to tick every box. If you’ve got strong Splunk fundamentals and you’re keen to learn across security and cloud, we’d like to hear from you.

Moving from a SOC into engineering?

If you’ve been working in a SOC or MSSP and spending more time onboarding data, fixing parsing and building searches than triaging alerts, this role is the next step. You’ll keep the Splunk depth you’ve built, move into a proper engineering role, and pick up PAM, cloud and automation skills along the way.

What’s on offer

• Certification and training support across Splunk, AWS and CyberArk
• Highly skilled senior engineers to learn from
• Real ownership of your work
• Variety across on‑prem, cloud and security platforms, not stuck in one tool
• Enterprise scale: large, real production environments
• Full‑time, permanent role, Sydney‑based (you must be Sydney‑based)
• Hybrid: remote work plus on‑site time at the client’s Sydney offices as required
• Occasional out‑of‑hours work for production change windows
• Valid Australian working rights are required. A national police check may be required for some client work