At a Glance
- Tasks: Onboard applications into Splunk and enhance security logging across environments.
- Company: Major ASX-listed company with a hands-on engineering team.
- Benefits: Competitive salary, remote work options, and opportunities for professional growth.
- Other info: Work remotely in Australia with experienced engineers and real ownership of projects.
- Why this job: Join a dynamic team and make a real impact in cyber security.
- Qualifications: 3+ years of Splunk experience and solid Linux fundamentals required.
The predicted salary is between 49500 - 60500 $ per year.
- Splunk-first security engineering role
- Exposure to Cyber Ark, AWS and Dev Sec Ops a plus
- Enterprise-scale environment at a major ASX-listed company
- About Our Client
Our client is a major ASX-listed company running enterprise-scale security platforms across on-premises and cloud, with a hands-on engineering team behind them.
About the Role
Our client is looking for a Cyber Security Engineer to own the onboarding of applications and data sources into Splunk, and to build out logging and detection coverage across their environment.
Splunk is the core of the role. Over time the work extends into privileged access with Cyber Ark, AWS, and
Dev Sec Ops practices such as automation, CI/CD and infrastructure-as-code. You'll work alongside senior
- What You'll Be Doing
- Onboarding applications and data sources into Splunk end to end: Universal and Heavy Forwarders, syslog, HEC, props and transforms, Technology Add-ons (TAs) and CIM normalisation.
- Working with application owners to define what needs to be logged and getting it in cleanly.
- Troubleshooting ingestion, parsing, timestamp and field extraction issues.
- Supporting and uplifting the Splunk platform: upgrades, indexer and search head clusters, deployment server and forwarder fleet management.
- Working with Splunk Enterprise Security: CIM compliance, correlation searches and tuning.
- Contributing to Cyber Ark PAM operations and AWS logging integrations where needed.
- Automating repetitive work with scripting and infrastructure-as-code.
- Delivering production changes, including occasional out-of-hours change windows.
- Documenting what you build so it can be handed over.
- What You Need
- 3+ years hands-on Splunk engineering or administration, including data onboarding (forwarders, props/transforms, TAs, CIM). Searching and dashboards alone is not enough.
- Experience supporting a production Splunk platform: upgrades, clustering, capacity and health.
- Solid Linux fundamentals, plus working knowledge of Windows Server.
- Networking basics: syslog, firewalls, DNS and connectivity troubleshooting.
- Australian citizenship or permanent residency.
- Nice to Have
- Splunk Admin, Power User or ES certification
- Infrastructure-as-code and CI/CD (Terraform, Cloud Formation, Ansible, Git pipelines)
- MSSP or consulting background across multiple environments (highly regarded)
- What's On Offer
- Remote within Australia
- Splunk depth plus a path into PAM, cloud and Dev Sec Ops
- Experienced senior engineers you'll work alongside
- Real ownership of your work in a large production environment
- Remote within Australia. Sydney-based candidates preferred for occasional team days.
- Occasional out-of-hours work for production change windows
- Must be an Australian citizen or permanent resident. A national police check may be required.
Cyber Security Engineer (Splunk SIEM) employer: Kelaru
Join a leading ASX-listed company that offers a dynamic and supportive work culture, where you can thrive as a Cyber Security Engineer in a remote setting across Australia. With competitive salaries and opportunities for professional growth in enterprise-scale environments, you'll collaborate with experienced engineers while gaining exposure to cutting-edge technologies like CyberArk and AWS. Enjoy the flexibility of remote work, real ownership of your projects, and the chance to make a meaningful impact in the field of cyber security.
