Splunk Cloud SIEM Engineer — Detection & Onboarding

DXC Technology Morocco; Western Australia; On-site; AUD 90,000 - 130,000; Full time

Job summary

DXC Technology is seeking a SIEM Engineer with strong Splunk Enterprise and Splunk Cloud experience to support enterprise SIEM environments, onboard new data sources, improve detection capabilities and ensure platform reliability.

You will engineer and support Splunk Enterprise and Splunk Cloud, manage indexers, search heads, forwarders, apps and add-ons, onboard log sources and develop SPL queries and dashboards. On-call rotation applies.

Qualifications

• Strong Splunk Enterprise and/or Splunk Cloud experience.
• Strong SPL and SIEM knowledge.
• Experience with Splunk CIM, apps/add-ons and forwarders.
• Experience onboarding security logs across multiple platforms.
• Understanding of SIEM, SOC operations and threat detection.
• Experience with syslog, APIs, JSON, XML and regular expressions.
• Strong troubleshooting skills across Linux, Windows and cloud.
• Strong communication and stakeholder management skills.
• Ability to obtain an Australian Government Security Clearance.

Responsibilities

• Engineer and support Splunk Enterprise and Splunk Cloud.
• Manage indexers, search heads, forwarders, apps and add-ons.
• Onboard and troubleshoot security log sources.
• Develop and tune SPL searches, alerts and dashboards.
• Support SOC teams with detection and investigation requirements.
• Troubleshoot ingestion, search and platform performance issues.
• Integrate Microsoft 365, Azure, AWS, EDR and identity data.
• Work with customers, vendors and internal teams.
• Maintain technical documentation and procedures.
• Participate in an on-call roster, typically 1–2 weeks per month.

Skills

Splunk Enterprise

Splunk Cloud

SPL

SIEM

CIM

Apps/Add-ons

Forwarders

Onboarding logs

Troubleshooting

Stakeholder comms

Tools

Splunk CIM

Apps/Add-ons

Forwarders

Syslog

APIs

JSON

XML

Regex

Job description

DXC Technology is seeking a SIEM Engineer with strong Splunk Enterprise and Splunk Cloud experience to support enterprise SIEM environments, onboard new data sources, improve detection capabilities and ensure platform reliability.

You will engineer and support Splunk Enterprise and Splunk Cloud, manage indexers, search heads, forwarders, apps and add-ons, onboard log sources and develop SPL queries and dashboards. On-call rotation applies.