Splunk Platform Engineer

Role Overview

We are looking for a skilled Splunk Platform Engineer to oversee and maintain a distributed Splunk environment hosted on Amazon Web Services (AWS). This position requires hands-on management of various Splunk components and collaboration with cross-functional teams to ensure optimal platform performance.

Key Responsibilities

• Manage Splunk Search Head and Indexer clusters, Deployers, Deployment Servers, Forwarders, and related infrastructure elements.
• Continuously monitor platform health, optimize performance, oversee data ingestion, storage, search operations, and alerting systems.
• Integrate new log sources by configuring inputs, parsing rules, timestamps, indexing, retention policies, and access permissions.
• Plan and perform Splunk upgrades, data migrations, patch installations, vulnerability fixes, and compatibility assessments.
• Support AWS-hosted Splunk infrastructure including managing log archival using services like S3 and Glacier.
• Handle incident resolution, problem management, change control, root cause investigations, and maintain comprehensive operational documentation.
• Coordinate with teams spanning security, cloud operations, infrastructure, application support, and external vendors.

Essential Qualifications & Skills

• In-depth understanding of Splunk architecture, especially in distributed setups.
• Proven experience in administering Splunk environments with expertise in clustering, migrations, upgrades, and troubleshooting issues.
• Proficient with Linux operating systems, notably Red Hat Enterprise Linux (RHEL) and Amazon Linux.
• Familiarity with AWS offerings such as EC2, S3, IAM, VPC, subnets, security groups, and CloudWatch monitoring.
• Strong scripting skills in Python, Bash, or shell scripting environments.
• Excellent written and verbal communication skills, effective documentation abilities, and capable of managing relationships with various stakeholders.

Preferred Experience

• Exposure to Splunk Enterprise Security, Splunk Cloud, or Splunk SOAR platforms.
• Experience with IT service management tools like ServiceNow or Jira and familiarity with ITIL frameworks.
• Background in security compliance, audit evidence preparation, and vulnerability handling.

Optional Certifications

• Splunk Enterprise Certified Administrator or Architect credentials.
• AWS Certified Solutions Architect at Associate or Professional level.
• Relevant certifications in Red Hat, Terraform, Ansible, ITIL, or cybersecurity fields.