Splunk Platform Engineer

XPT Software Australia; City of Melbourne; On-site; AUD 140,000 - 180,000; Full time

Job summary

XPT Software Australia is seeking an experienced Splunk Platform Engineer to manage a distributed Splunk environment hosted on AWS in Melbourne. You will administer clusters, deployers, and forwarders while ensuring reliability of logs and data pipelines.

You will monitor platform health, onboard new log sources, plan upgrades, perform migrations, and coordinate with security, cloud, and vendor teams to maintain security and compliance.

Qualifications

• Experience administering Splunk in distributed environments.
• Strong knowledge of Splunk architecture and troubleshooting concepts.
• Proficient in Linux (RHEL/Amazon Linux) and scripting (Python, Bash).
• Experience with AWS services (EC2, S3, IAM, VPC, CloudWatch) and logging pipelines.

Responsibilities

• Administer Splunk Search Head and Indexer clusters, Deployers, Deployment Servers, Forwarders, and supporting components.
• Monitor and troubleshoot platform health, performance, data ingestion, storage, searches, and alerts.
• Onboard log sources and configure inputs, parsing, timestamps, indexes, retention, and access controls.
• Plan and execute Splunk upgrades, migrations, patching, vulnerability remediation, and compatibility testing.
• Support AWS-based Splunk infrastructure and S3/Glacier log archival.
• Manage incidents, problems, changes, root-cause analysis, and operational documentation.
• Work with security, cloud, infrastructure, application, and vendor teams.

Skills

Splunk administration

Linux (RHEL/Amazon Linux)

Python scripting

AWS services (EC2, S3, IAM, VPC)

Communication/stakeholder management

Tools

Splunk Enterprise

AWS

ServiceNow

Jira

ITIL

Job description

We are seeking an experienced Splunk Platform Engineer to manage and support a distributed Splunk environment hosted on AWS.

Key Responsibilities

• Administer Splunk Search Head and Indexer clusters, Deployers, Deployment Servers, Forwarders, and supporting components.
• Monitor and troubleshoot platform health, performance, data ingestion, storage, searches, and alerts.
• Onboard log sources and configure inputs, parsing, timestamps, indexes, retention, and access controls.
• Plan and execute Splunk upgrades, migrations, patching, vulnerability remediation, and compatibility testing.
• Support AWS-based Splunk infrastructure and S3/Glacier log archival.
• Manage incidents, problems, changes, root-cause analysis, and operational documentation.
• Work with security, cloud, infrastructure, application, and vendor teams.

Required Skills

• Strong knowledge of Splunk architecture and distributed environments.
• Hands-on experience with Splunk administration, clustering, upgrades, migrations, and troubleshooting.
• Experience with Linux, particularly RHEL and Amazon Linux.
• Working knowledge of AWS services, including EC2, S3, IAM, VPC, Subnets, Security Groups, and CloudWatch.
• Proficiency in Python, Bash, or Shell scripting.
• Strong communication, documentation, and stakeholder-management skills.

Desirable Experience

• Splunk Enterprise Security, Splunk Cloud, or Splunk SOAR.
• ServiceNow or Jira and ITIL-based service-management processes.
• Security compliance, audit evidence, and vulnerability management.

Certifications – Optional

• Splunk Enterprise Certified Admin or Architect.
• AWS Certified Solutions Architect – Associate or Professional.
• Relevant Red Hat, Terraform, Ansible, ITIL, or security certification.