Splunk Platform Engineer

Overview

Splunk Platform Engineer responsible for administering, deploying and maintaining Splunk Enterprise and Splunk Cloud, including forwarders, data onboarding, upgrades and vulnerability remediation.

What you'll do

• Install, configure and maintain Splunk forwarders (127 in the estate) and onboard new data sources.
• Administer Splunk Cloud, including app and version upgrades, certificates and RBAC.
• Plan and execute ACSC-approved changes in the change window, with rollback plans and post-change validation.
• Validate, remediate and execute change for Splunk vulnerabilities, including zero-day vulnerabilities, highest priority first.
• Support ITSI services, KPIs and episodes.
• Support OpenTelemetry collectors and Splunk Observability Cloud.
• Monitor Splunk system health using built-in and custom monitoring scripts and dashboards.
• Raise and track Splunk vendor cases once ACSC authorizes named Unisys personnel on the ACSC Splunk account.
• Write and maintain runbooks and service documentation; automate repeat work through ACSC-approved changes.
• Hand over work in progress to Shift B during the 05:00-06:00 PT warm handover.
• Deploy and maintain Splunk Enterprise and Splunk Cloud, including indexer clusters, search head clusters, heavy and universal forwarders, deployment servers, and license masters.
• Manage capacity, performance tuning, and data retention.
• Monitor platform health and troubleshoot indexing, search, and forwarding issues.
• Onboard and normalize data sources (syslog, HEC, cloud logs, application and infrastructure logs).
• Write props/transforms and parsing configurations, and map data to CIM.
• Automate deployments, upgrades, and configuration management with tools such as Ansible, Terraform, Git, and CI/CD pipelines.
• Build and maintain apps, add-ons, dashboards, alerts, and reports.
• Write efficient SPL for stakeholders.
• Implement role-based access control, SSO/LDAP integration, encryption, and audit controls.
• Plan and execute upgrades, patching, migrations, and disaster recovery.
• Partner with security, SRE, and application teams.
• Document standards and runbooks, and mentor junior engineers.
• Participate in the on-call rotation for platform incidents.

What you'll need

• BA/BS degree and 5+ years' relevant experience OR equivalent combination of education and experience.
• Over 4 years of hands-on Splunk administration, including Splunk Cloud and universal and heavy forwarders.
• Forwarder deployment and configuration management at scale (deployment server or equivalent).
• Splunk app, version and certificate management; role-based access control.
• Linux and Windows administration sufficient to troubleshoot forwarder hosts.
• Change management discipline in an ITIL-style environment, including working to approved change records.
• Familiarity with vulnerability remediation and patch validation.
• Clear written and spoken English; comfortable working a night-time shift pattern aligned to Pacific Time.

Nice to have

• Splunk Certified Admin or Splunk Core Certified Power User or higher.
• ITSI and Splunk Observability Cloud experience; OpenTelemetry collector configuration.
• Scripting (Python, Bash or PowerShell) and automation tooling.
• Experience with ServiceNow or a comparable ticketing system.
• Experience with cloud platforms (AWS, Azure, or GCP) and containers (Kubernetes, Docker).
• Experience with Splunk ITSI, Enterprise Security, SOAR, or Observability Cloud.
• Knowledge of OpenTelemetry, Cribl, Kafka, or other data pipeline tools.
• Experience with ITIL or Agile practices.

Details

• Location: Bangalore, KA, India.
• Night-time shift pattern aligned to Pacific Time, including the 05:00-06:00 PT warm handover.
• Participation in the on-call rotation for platform incidents.