Splunk Platform Engineer

Overview

Join our team as a Splunk Platform Engineer responsible for managing and optimizing the Splunk ecosystem, ensuring platform stability, and supporting cloud-based infrastructure. This role involves administration, maintenance, and enhancement of Splunk clusters and components in a production setting.

Key Responsibilities

• Oversee administration of Splunk Search Head and Indexer clusters, as well as Deployers, Deployment Servers, and Forwarders.
• Continuously monitor platform health, troubleshoot performance issues related to data ingestion, storage, searches, and alerts.
• Integrate new log sources, configure inputs including parsing, time stamps, indexing, retention policies, and access permissions.
• Lead and implement upgrades, migrations, patch applications, vulnerability remediation, and conduct compatibility testing within the Splunk environment.
• Support AWS-hosted Splunk infrastructure, including archival solutions using S3 and Glacier storage.
• Handle incidents, conduct root-cause analysis, facilitate change management, and maintain comprehensive operational documentation.
• Collaborate with multiple teams such as security, cloud, infrastructure, application, and third-party vendors to maintain system integrity.

Required Skills and Experience

• Extensive understanding of Splunk architecture with experience managing distributed environments.
• Practical expertise in Splunk administration tasks including clustering, performing upgrades, migrations, and troubleshooting operational issues.
• Proficiency with Linux operating systems, specifically Red Hat Enterprise Linux and Amazon Linux.
• Familiarity with AWS core services like EC2, S3, IAM, VPC, Subnets, Security Groups, and monitoring tools like CloudWatch.
• Strong scripting abilities using Python, Bash, or Shell to automate tasks and improve efficiency.
• Excellent communication, documentation skills, and ability to manage stakeholder expectations effectively.

Preferred Experience

• Knowledge of Splunk Enterprise Security suite, Splunk Cloud platform, or Splunk SOAR for extended security operations.
• Experience working with IT service management tools such as ServiceNow or Jira and following ITIL frameworks.
• Understanding of security compliance standards, audit evidence requirements, and vulnerability management processes.

Certifications (Optional)

• Splunk Enterprise Certified Admin or Architect credentials.
• AWS Certified Solutions Architect – Associate or Professional level.
• Additional certifications related to Red Hat, Terraform, Ansible, ITIL, or security domains.