Senior Splunk Data Onboarding & CIM Specialist

Xpt Software Australia Pty; Melbourne; On-site; AUD 120,000 - 180,000; Full time

Job summary

Xpt Software Australia Pty is seeking a mid to senior Splunk Data Administrator to own and continually improve Splunk data onboarding, normalization, and quality across a complex hybrid Splunk environment. You will lead CIM-aligned onboarding, field extractions, and TA deployments, ensuring sources are parsed consistently for security analytics and dashboards.

The role requires hands-on experience with Splunk architecture, data models, and SPL development, plus strong Linux and AWS familiarity

Qualifications

• 5–10 years of Splunk administration and data onboarding experience.
• Hands-on with CIM alignment, data source onboarding, and field extractions.
• Experience with props.conf/transforms.conf, sourcetypes, timestamps, and line-breaking.

Responsibilities

• Lead end-to-end onboarding of new log sources and CIM alignment.
• Configure and maintain Splunk TA installations across clusters.
• Develop and validate SPL for data quality and CIM compliance.
• Support hybrid on-prem + cloud Splunk architecture and governance.

Skills

Splunk administration

CIM normalization

Data onboarding

Regular expressions

SPL

Linux

AWS

Ansible

Terraform

Jenkins

Tools

Splunk

Ansible

Terraform

Jenkins

Job description

Xpt Software Australia Pty is seeking a mid to senior Splunk Data Administrator to own and continually improve Splunk data onboarding, normalization, and quality across a complex hybrid Splunk environment. You will lead CIM-aligned onboarding, field extractions, and TA deployments, ensuring sources are parsed consistently for security analytics and dashboards.

The role requires hands-on experience with Splunk architecture, data models, and SPL development, plus strong Linux and AWS familiarity