Splunk Platform Engineer

Unisys; Bengaluru; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

Unisys is seeking an experienced Splunk Administrator to install, configure, and maintain Splunk forwarders and Splunk Cloud, onboard new data sources, and ensure security through RBAC, encryption, and audits.

You will manage deployments, perform vulnerability remediation, and support ITSI and Observability Cloud services, while coordinating changes within ITIL guidelines and ensuring 24/7 readiness for a Pacific-time aligned shift.

Qualifications

• BA/BS degree or higher in related field; 5+ years relevant experience.
• Over 4 years of hands-on Splunk administration, including Splunk Cloud and universal and heavy forwarders.
• Forwarder deployment and configuration management at scale (deployment server or equivalent).
• Splunk app, version and certificate management; RBAC.
• Linux and Windows administration sufficient to troubleshoot forwarder hosts.
• ITIL-style change management with approved change records.
• Familiarity with vulnerability remediation and patch validation.
• Clear written and spoken English; night-time shift aligned to Pacific Time.
• Splunk Certified Admin or Splunk Core Certified Power User or higher.
• ITSI and Splunk Observability Cloud experience; OpenTelemetry collector configuration.
• Scripting (Python, Bash or PowerShell) and automation tooling.
• ServiceNow or similar ticketing system experience.
• Cloud platforms (AWS, Azure, or GCP) and containers (Kubernetes, Docker).
• Experience with Splunk ITSI, Enterprise Security, SOAR, or Observability Cloud.
• Knowledge of OpenTelemetry, Cribl, Kafka, or other data pipeline tools.
• ITIL or Agile practices.

Responsibilities

• Install, configure and maintain Splunk forwarders (127 in the estate).
• Onboard new data sources and administer Splunk Cloud apps and certs.
• Plan changes with rollback plans and post-change validation.
• Validate and remediate Splunk vulnerabilities; prioritize high risk.
• Support ITSI services, KPIs and incidents.
• Support OpenTelemetry collectors and Splunk Observability Cloud.
• Monitor system health with scripts and dashboards.
• Write and maintain runbooks and automate repeat work.
• Hand over work during 05:00-06:00 PT warm handover.
• Deploy and maintain Splunk Enterprise and Cloud components.
• Manage capacity, performance tuning, and data retention.
• Onboard and map data sources to CIM; write props/transforms.
• Automate deployments with Ansible, Terraform, Git, CI/CD.
• Build apps, dashboards, alerts, and reports; write SPL for stakeholders.
• Implement RBAC, SSO/LDAP, encryption and audit controls.

Skills

Splunk administration

Splunk Cloud

Python / Bash

ITIL change mgmt

Automation

OpenTelemetry

Kubernetes / Docker

English comms

Education

BA/BS degree or higher in related field

Tools

Splunk

Ansible

Terraform

Git

CI/CD

ServiceNow

AWS

Azure

GCP

Kubernetes

Docker

Job description

What success looks like in this role:

Install, configure and maintain Splunk forwarders (127 in the estate) and onboard new data sources.

Administer Splunk Cloud: app and version upgrades, certificates and RBAC.

Plan and execute ACSC-approved changes in the change window, with rollback plans and post-change validation.

Validate, remediate and execute change for Splunk vulnerabilities, including zero-day vulnerabilities, highest priority first.

Support ITSI services, KPIs and episodes.

Support OpenTelemetry collectors and Splunk Observability Cloud.

Monitor Splunk system health using built-in and custom monitoring scripts and dashboards.

Raise and track Splunk vendor cases once ACSC authorizes named Unisys personnel on the ACSC Splunk account.

Write and maintain runbooks and service documentation; automate repeat work through ACSC-approved changes.

Hand over work in progress to Shift B during the 05:00-06:00 PT warm handover.

Deploy, and maintain Splunk Enterprise and Splunk Cloud, including indexer clusters, search head clusters, heavy and universal forwarders, deployment servers, and license masters.

Manage capacity, performance tuning, and data retention. Monitor platform health and troubleshoot indexing, search, and forwarding issues.

Onboard and normalize data sources (syslog, HEC, cloud logs, application and infrastructure logs). Write props/transforms and parsing configurations, and map data to CIM.

Automate deployments, upgrades, and configuration management with tools such as Ansible, Terraform, Git, and CI/CD pipelines.

Build and maintain apps, add-ons, dashboards, alerts, and reports. Write efficient SPL for stakeholders.

Implement role-based access control, SSO/LDAP integration, encryption, and audit controls.

Plan and execute upgrades, patching, migrations, and disaster recovery.

Partner with security, SRE, and application teams. Document standards and runbooks, and mentor junior engineers.

Participate in the on-call rotation for platform incidents.

#LI-SN1

You will be successful in this role if you have:

• BA/BS degree and 5+ years' relevant experience OR equivalent combination of education and experience.
• Over 4 years of Hands-on Splunk administration, including Splunk Cloud and universal and heavy forwarders
• Forwarder deployment and configuration management at scale (deployment server or equivalent).
• Splunk app, version and certificate management; role-based access control.
• Linux and Windows administration sufficient to troubleshoot forwarder hosts.
• Change management discipline in an ITIL-style environment, including working to approved change records.
• Familiarity with vulnerability remediation and patch validation.
• Clear written and spoken English; comfortable working a night-time shift pattern aligned to Pacific Time.
• Splunk Certified Admin or Splunk Core Certified Power User or higher.
• ITSI and Splunk Observability Cloud experience; OpenTelemetry collector configuration.
• Scripting (Python, Bash or PowerShell) and automation tooling.
• Experience with ServiceNow or a comparable ticketing system.
• Experience with cloud platforms (AWS, Azure, or GCP) and containers (Kubernetes, Docker).
• Experience with Splunk ITSI, Enterprise Security, SOAR, or Observability Cloud.
• Knowledge of OpenTelemetry, Cribl, Kafka, or other data pipeline tools.
• Experience with ITIL or Agile practices.

Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.

Local employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.

If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [e-mail] . US job seekers can find more information about Unisys' EEO commitment here .