Splunk Platform Engineer

Overview

We are currently recruiting a skilled Splunk Platform Engineer to oversee and maintain a distributed Splunk environment hosted within AWS infrastructure.

Primary Responsibilities

• Manage and administer Splunk Search Head clusters, Indexer clusters, Deployers, Deployment Servers, Forwarders, along with associated components.
• Continuously monitor and resolve issues relating to platform health, system performance, data ingestion processes, storage management, search operations, and alert generation.
• Integrate new log sources, setting up inputs, parsing rules, timestamp configurations, indexes, data retention policies, and access control mechanisms.
• Plan and implement Splunk system upgrades, migrations, patching routines, vulnerability mitigations, and conduct compatibility testing to ensure seamless operations.
• Provide support for AWS-hosted Splunk infrastructure, including handling log archiving via S3 and Glacier services.
• Handle incident management, problem resolution, change management, root cause analyses, and maintain detailed operational documentation.
• Collaborate closely with cross-functional teams such as security, cloud operations, infrastructure, application development, and vendor partners.

Essential Skills and Experience

• Deep understanding of Splunk architecture with hands-on experience managing distributed environments.
• Practical expertise in Splunk administration operations including clustering, system upgrades, migrations, and troubleshooting.
• Proficiency with Linux-based operating systems, specifically Red Hat Enterprise Linux and Amazon Linux.
• Familiarity with Amazon Web Services components such as EC2, S3, IAM, VPC, Subnets, Security Groups, and CloudWatch monitoring.
• Competence in scripting languages including Python, Bash, or Shell to automate tasks.
• Excellent verbal and written communication skills, thorough documentation ability, and effective stakeholder management.

Desirable Qualifications and Experience

• Exposure to Splunk Enterprise Security, Splunk Cloud services, or Splunk SOAR platforms.
• Experience with ServiceNow, Jira, and adherence to ITIL service-management methodologies.
• Knowledge of security compliance standards, audit procedures, and vulnerability management strategies.

Certifications (Optional but Advantageous)

• Splunk Enterprise Certified Administrator or Architect credentials.
• AWS Certified Solutions Architect at Associate or Professional level.
• Certifications in Red Hat technologies, Terraform, Ansible, ITIL frameworks, or relevant security fields.