Splunk administrator

Overview

We are looking for an experienced Splunk Architect/Senior Splunk Administrator to support and enhance a large-scale Splunk environment.

The role requires a strong mix of architectural knowledge and hands-on administration experience across Splunk Enterprise 9.x+ in clustered environments.

Key Skills & Experience

• Splunk Enterprise Administration
• Splunk environment design and architecture.
• Administration of Indexer and Search Head Clusters.
• Splunk upgrades and platform maintenance.
• Forwarder installation, configuration and troubleshooting.
• Data onboarding, parsing and data quality improvements.
• End-to-end SSL implementation across Splunk components.
• PCRE (Perl Compatible Regular Expressions).
• Data models, data model accelerations and summarised searches.
• Development of knowledge objects, dashboards and alerts.
• Platform health checks, optimisation and troubleshooting.
• Python Scripting (desirable).

Splunk Enterprise Security (ES)

• ES data models and CIM compliance.
• Correlation searches and notable event management.
• ES content development and administration.

Technical Environment

• Experience working with Splunk environments managed through CI/CD pipelines.
• Strong Unix/Linux administration skills.
• Windows/PowerShell experience.
• Experience supporting hybrid cloud and on-premise environments.

Personal Attributes

• Strong analytical and problem-solving skills.
• Excellent communication and stakeholder management.
• Collaborative team player with strong coordination skills.

Desirable Experience

• Splunk Cloud (SaaS).
• Splunk SOAR.
• Splunk Enterprise Security administration.
• Splunk migration, consolidation or transformation projects.

This is an excellent opportunity for a hands-on Splunk specialist who can operate at both technical and architectural levels within a complex enterprise environment.