About Us ALOIS Australia is a leading Talent and Technology Solutions company, focused on helping businesses across the country build stronger teams, smarter processes, and sustainable growth.

We work with organisations in diverse industries to deliver integrated workforce and technology solutions, from innovative hiring strategies to end-to-end digital transformation. Our approach combines data, insight, and human expertise to help clients solve complex workforce challenges with clarity and confidence.

Through our deep industry experience and commitment to excellence, we provide scalable, high-performance solutions that deliver measurable impact. Whether it’s onshore project delivery, workforce optimisation, or specialised technology services, ALOIS Australia ensures results that truly make a difference.

From Sydney to Perth and everywhere in between, we’re driven by one purpose: to empower Australian businesses and professionals to thrive in a rapidly changing world of work. At ALOIS Australia, every challenge is an opportunity to innovate, and every partnership is built on trust, transparency, and long-term success.

Job Title – Splunk Data Administrator (Mid–Senior) – CIM / Data Onboarding / Hybrid Architecture

Job Location – MELBOURNE

Employment Type – Contract/FTC

What Role You Will Play In Team Job Title

Splunk Data Administrator (Mid–Senior) – CIM / Data Onboarding / Hybrid Architecture

Role Summary

We are seeking a mid to senior Splunk Data Administrator to own and continuously improve Splunk data onboarding, normalization, and quality across a complex hybrid Splunk environment (on‑prem and cloud).

The ideal candidate is hands-on with CIM alignment, data source onboarding, field extractions (regex/props/transforms/ingest actions), TA deployment, and end-to-end operational management of Splunk data pipelines.

You will act as the key point of contact for ensuring log sources are onboarded correctly, parsed and normalized consistently, and made usable for security/IT operations, dashboards, correlation searches, and reporting.

Key Responsibilities

Data Onboarding & Lifecycle Management

- Lead onboarding of new log sources end-to-end: requirements gathering, source validation, parsing strategy, TA selection/deployment, CIM alignment, testing, and release.
- Partner with Security/IT teams to translate use-cases into data requirements, ensuring sources deliver the right fidelity, timeliness, and coverage.
- Manage onboarding at scale using best practices for source types,



metadata strategy, index & sourcetype governance, and naming conventions.
- Define and enforce data quality standards (field completeness, timestamps, event consistency, parsing accuracy, duplication control).

CIM Normalization & Data Modelling
- Normalize data to Splunk Common Information Model (CIM) with strong understanding of data models (e.g., Authentication, Network Traffic, Endpoint, Change, etc.).
- Ensure fields are aligned to CIM requirements to support Splunk Enterprise Security (ES) and other CIM-based content.
- Validate normalization using SPL and develop reusable onboarding checklists.

Field Extraction, Parsing & Enrichment
- Design and implement robust field extractions using:
- props.conf / transforms.conf, REPORT/TRANSFORMS stanzas
- regex and structured parsing (KV_MODE, JSON, XML)
- ingest-time vs search-time extraction strategy
- sourcetype / timestamp / line breaking configuration
- Implement enrichment and routing using event breaking, host/source normalization, lookups, and tagging.
- Troubleshoot parsing issues (timestamp drift, multi-line events, encoding, truncation, duplicate ingestion, broken extractions).

TA Installation & Configuration (Complex / Hybrid)
- Install, configure, and maintain Splunk Add-ons (TAs) and apps across:
- Heavy Forwarders / Universal Forwarders
- Indexers / Search Heads / SHC
- Deployment Server / Cluster Manager (where applicable)
- Maintain version compatibility and upgrade strategies for:
- Splunk Enterprise / Splunk Cloud
- Add-ons, apps, and content packs
- Package and deploy TAs using deployment pipelines and change management controls.
- Ensure fields are aligned to CIM requirements

Hybrid Splunk Architecture Operations
- Operate and support Splunk in complex environments:
- On-prem Indexer Cluster, Search Head Cluster, Forwarder tiers
- Splunk Cloud integrations where applicable (e.g., Heavy Forwarder, VPN, PrivateLink, data forwarding patterns)
- Configure and troubleshoot data ingestion pipelines:
- Syslog (UDP/TCP), API-based collection, HEC, file monitors, Windows Event Logs, cloud sources
- Ensure performance and reliability across the pipeline,



including indexing throughput, parsing overhead, and search impact.

Monitoring, Troubleshooting & Governance
- Monitor ingestion health and pipeline performance:
- Forwarder health, queue saturation, parsing/indexing delays, dropped events
- Maintain governance for indexes, sourcetypes, retention, RBAC and data access boundaries (as required).
- Contribute to operational runbooks, SOPs, and documentation; drive continuous improvement in onboarding and normalization standards.

Required Skills & Experience (Mid–Senior)

- 5–10 years experience with Splunk administration and data onboarding (or equivalent depth).
- Solid practical knowledge of:
- CIM normalization, tags/eventtypes, datamodel alignment
- Field extraction (regex, JSON/KV extraction), and troubleshooting parsing issues
- props.conf / transforms.conf, sourcetypes, timestamps, line-breaking
- TA installation/configuration and deployment patterns across Splunk tiers
- Experience with complex Splunk architectures:
- Indexer clusters, SH/SHC, forwarder management, deployment server
- Hybrid patterns (on-prem + cloud), connectivity, and ingestion strategies
- Comfortable writing and validating SPL for data quality and CIM compliance.
- Strong log source knowledge across common domains:
- Security: EDR, firewall, proxy, IAM/auth, VPN, email security
- Infrastructure: Windows, Linux, network devices, virtualization
- Cloud: AWS/Azure/GCP logging patterns (nice-to-have)

Preferred / Nice-to-Have

- Experience with Splunk Enterprise Security (ES) and ES add-ons / CIM compliance expectations.
- Knowledge of Splunk Ingest Actions / Edge Processor (or modern ingestion tools, where applicable).
- Familiarity with:
- HEC, API ingestion, message queues
- ITSI / Observability (bonus)
- Splunk certifications (preferred):
- Splunk Core Certified Power User / Admin
- Splunk Enterprise Certified Admin
- Splunk ES Admin (bonus)

Stay Connected With Us Learn more about ALOIS in Australia, visit our webpage ALOIS Australia Follow us on LinkedIn and Instagram

EEO Statement ALOIS Australia is committed to fostering a diverse and inclusive workplace. We provide equal employment opportunities to all qualified applicants and do not discriminate on the basis of race, colour, religion, sex, age, national origin, disability, or any other characteristic protected under applicable laws. We value diversity and believe it strengthens our people, our culture, and the outcomes we deliver.

📌 Splunk Data Administrator (Mid–Senior) – CIM / Data Onboarding / Hybrid Architecture (City of Perth)
🏢 ALOIS UK
📍 City of Perth