Senior Splunk & Observability Engineer

System One; Knoxville (TN); On-site; USD 120,000 - 180,000; Full time

Job summary

System One seeks a Senior Splunk & Observability Engineer to manage enterprise observability platforms within an AWS-based production environment. The role combines Splunk administration, AWS support, and automation to enhance monitoring and resiliency.

Responsibilities include SPL development, dashboards, data lifecycle management, and upgrades. You will collaborate across teams to ensure optimal performance and incident response.

Qualifications

• 5+ years hands-on Splunk Enterprise administration in large production environments
• Strong Splunk ecosystem knowledge: ingestion, forwarders, indexers, search heads, dashboards, alerts, recovery
• Advanced SPL query development and performance optimization
• Experience deploying, configuring, upgrading, and supporting Splunk on AWS
• Strong AWS production experience: EC2, Application Load Balancer, CloudWatch
• Experience building complex Splunk dashboards for production monitoring and incident triage
• OpenTelemetry knowledge: agents, collectors, logs, metrics, instrumentation, Splunk integration
• Python for automation and ops tooling
• Experience with GitLab, Terraform Enterprise, CI/CD, GitHub, JSON
• Strong troubleshooting: ingestion failures, data volume issues, outages, performance problems
• Platform upgrades, patches, vulnerability remediation, controlled production changes
• Ability to lead troubleshooting calls and coordinate across teams

Responsibilities

• Administer, engineer, upgrade, and support Splunk Enterprise in AWS
• Deploy, configure, troubleshoot Splunk components on EC2
• Manage end-to-end Splunk data lifecycle: ingestion, indexing, search, dashboards, alerts, retention
• Develop and optimize SPL queries and troubleshoot performance
• Build and maintain enterprise dashboards for production monitoring and resiliency
• Troubleshoot ingestion failures and data issues; manage outages and data recovery
• Restore data flow and replay data after interruptions
• Integrate Splunk with CloudWatch and OpenTelemetry for logs, metrics, alerts
• Develop Python automation for observability and platform ops
• Maintain OpenTelemetry agent/collector packages across platforms
• Support upgrades, patches, plugins, vulnerability remediation
• Use GitLab/GitHub, Terraform Enterprise, and JSON for CI/CD and deployments
• Lead troubleshooting calls and coordinate across cloud, app, security, and prod support teams
• Participate in on-call rotation and after-hours support when required

Skills

Splunk Enterprise

AWS

OpenTelemetry

Python automation

CI/CD

Education

Bachelor's degree in Computer Science/Information Systems or related field

Tools

GitLab

GitHub

Terraform Enterprise

JSON

CI/CD tooling

Amazon EC2

Application Load Balancer

CloudWatch

Job description

Senior Splunk & Observability Engineer

Job Type: Permanent Full Time
Location: Knoxville, TN, Columbia SC or Lafayette, LA or Birmingham, AL

Position Description

Seeking an experienced Senior Splunk & Observability Engineer to support enterprise scale observability platforms within a complex, AWS based production environment. This is a senior hands on role combining advanced Splunk administration and engineering, AWS production support, observability, and automation.

The engineer will manage and support Splunk Enterprise running on AWS, working across the full data lifecycle from source onboarding and ingestion through indexing, search, dashboards, alerts, retention, and recovery. Responsibilities include developing and optimizing SPL queries, troubleshooting ingestion and performance issues, improving platform stability, supporting upgrades and vulnerability remediation, and restoring or replaying data following service interruptions.

The role will also work extensively with AWS, Amazon CloudWatch, OpenTelemetry, and Python based automation to improve enterprise monitoring and resiliency. The engineer will build and maintain OpenTelemetry agents and collectors, support observability integrations across technology stacks, and help automate platform operations and vulnerability remediation.

This position is required in one of the following locations: Lafayette, LA, Knoxville, TN, Columbia, SC, Birmingham, AL

Your future duties and responsibilities

• Administer, engineer, upgrade, and support Splunk Enterprise in AWS.
• Deploy, configure, and troubleshoot Splunk components hosted on Amazon EC2.
• Manage the end to end Splunk data lifecycle, including ingestion, indexing, search, dashboards, alerts, retention, and recovery.
• Develop and optimize complex SPL queries and troubleshoot query performance issues.
• Build and maintain enterprise dashboards for production monitoring, resiliency, incident response, and outage triage.
• Troubleshoot ingestion failures, problematic indexes, missing or delayed data, unexpected data volume growth, and platform availability issues.
• Restore data flow and replay data following ingestion or platform interruptions.
• Optimize data ingestion and retention to reduce noise, storage consumption, and operating costs.
• Integrate Splunk, Amazon CloudWatch, and OpenTelemetry for logs, metrics, dashboards, and alerts.
• Develop Python based automation for observability and platform operations.
• Build and maintain OpenTelemetry agent and collector packages across multiple technology platforms.
• Support Splunk upgrades, patching, configuration changes, plugins, and vulnerability remediation.
• Use GitLab, GitHub, Terraform Enterprise, JSON, and CI/CD tooling to support infrastructure, configuration, automation, and package deployments.
• Lead technical troubleshooting calls and coordinate incident investigation and remediation across multiple teams.
• Participate in an on call rotation and provide after hours support when required for production incidents, upgrades, and planned changes.

Required qualifications to be successful in this role

• 5+ years of hands on Splunk Enterprise administration and engineering experience in large production environments.
• Strong understanding of the Splunk ecosystem, including data ingestion, forwarders, indexers, search heads, indexes, dashboards, alerts, and recovery.
• Advanced SPL query development and performance optimization skills.
• Hands on experience deploying, configuring, upgrading, troubleshooting, and supporting Splunk on AWS.
• Strong AWS production experience, particularly with Amazon EC2, Application Load Balancer, and Amazon CloudWatch.
• Experience building complex Splunk dashboards for production monitoring, resiliency, incident triage, and operational use cases.
• Strong understanding of OpenTelemetry, including agents, collectors, logs, metrics, instrumentation, and Splunk integration.
• Experience building or maintaining OpenTelemetry agent and collector packages.
• Working knowledge of Python for automation and operational tooling.
• Experience with GitLab, Terraform Enterprise, CI/CD, GitHub, and JSON.
• Strong production troubleshooting skills, including ingestion failures, data volume issues, platform outages, performance problems, and data recovery.
• Experience with platform upgrades, patching, vulnerability remediation, and controlled production changes.
• Ability to lead technical troubleshooting calls, communicate findings clearly, and coordinate effectively across cloud, application, security, database, and production support teams.

Educational Requirements

?Bachelor's degree in Computer Science, Information Systems, or a related field.??

Ref: #404-IT Pittsburgh