- Experience
- 5–10 yrs
- Salary
- —
- Openings
- 1
- Posted
- 3 weeks ago
- Work mode
- In office
- Eligibility
- Applicants must hold full working rights in Australia to be eligible.
- Resume
- Required to apply
Where you'll work
Sign in to tell us what does and doesn't work for you here — it sharpens every match we show you.
Job description
About the Role
ITbility is seeking an experienced Splunk Data Administrator for a permanent position based in Melbourne, Victoria. This role involves managing Splunk environments, ensuring data onboarding accuracy, and maintaining overall system integrity.
Key Responsibilities
- Administer and onboard data to Splunk platforms effectively.
- Implement and manage CIM normalization, including tags, event types, and data model alignment.
- Extract fields using regular expressions, JSON/KV extraction, and resolve parsing problems.
- Install and configure Technology Add-ons (TAs) and manage deployment workflows across various Splunk tiers.
- Maintain complex Splunk setups, including indexer clusters, search heads/search head clusters, forwarder administration, and deployment servers.
- Manage hybrid deployment architectures combining on-premises and cloud environments, optimizing connectivity and ingestion strategies.
- Develop, write, and validate SPL queries to ensure data quality and CIM compliance.
Required Skills and Experience
- Between 5 to 10 years of hands-on experience in Splunk administration and data onboarding.
- Comprehensive knowledge of CIM normalization processes, including working with tags and event types.
- Advanced expertise in field extraction techniques and troubleshooting data parsing.
- Experience with configuring and deploying TAs and managing deployment patterns within Splunk ecosystems.
- Strong abilities with complex Splunk architectures, including managing indexer clusters, search heads, forwarders, and deployment servers.
- Familiarity with hybrid cloud and on-premises environments, including connectivity and ingestion considerations.
- Proficient in writing and testing SPL queries to ensure compliance with CIM standards.
- Extensive log source knowledge covering security domains such as EDR, firewall, proxy, IAM/authentication, VPN, and email security.
- Infrastructure logging experience including Windows, Linux, network devices, and virtualization systems.
- Preferable knowledge of cloud logging environments such as AWS, Azure, or GCP.
Eligibility and Additional Information
Candidates must possess full working rights in Australia to be considered. Only shortlisted applicants will be contacted. Interested individuals should submit their resumes promptly for immediate consideration.