Cyber Security Engineer (Splunk SIEM)

Kelaru

Location: Australia-wide, remote (Sydney preferred but not required)

Employment Type: Full-time, Permanent

Salary: $140,000 to $150,000 + super

- Splunk-first cyber security engineering role
- Exposure to CyberArk, AWS and DevSecOps a plus
- Enterprise-scale environment at a major ASX-listed company

About Our Client

Our client is a major ASX-listed company running enterprise-scale security platforms across on-premises

and cloud, with a hands-on engineering team behind them.

About the Role

Our client is looking for a Cyber Security Engineer to own the onboarding of applications and data

sources into Splunk, and to build out logging and detection coverage across their workplace.

Splunk is the core of the role. Over time the work extends into privileged access with CyberArk, AWS, and

DevSecOps practices such as automation, CI/CD and infrastructure-as-code. You'll work alongside senior

engineers on production systems.

What You'll Be Doing

- Onboarding applications and data sources into Splunk end to end: Universal and Heavy

Forwarders, syslog, HEC, props and transforms, Technology Add-ons (TAs) and CIM normalisation.

- Working with application owners to define what needs to be logged and getting it in cleanly.
- Troubleshooting ingestion, parsing, timestamp and field extraction issues.
- Supporting and uplifting the Splunk platform: upgrades, indexer and search head clusters,

deployment server and forwarder fleet management.

- Working with Splunk Enterprise Security: CIM compliance, correlation searches and tuning.
- Contributing to CyberArk PAM operations and AWS logging integrations where needed.
- Automating repetitive work with scripting and infrastructure-as-code.
- Delivering production changes, including occasional out-of-hours change windows.




- Documenting what you build so it can be handed over.

What You Need

- 3+ years hands-on Splunk engineering or administration, including data onboarding (forwarders,

props/transforms, TAs, CIM). Searching and dashboards alone is not enough.

- Experience supporting a production Splunk platform: upgrades, clustering, capacity and health.
- Solid Linux fundamentals, plus working knowledge of Windows Server.
- Networking basics: syslog, firewalls, DNS and connectivity troubleshooting.
- Scripting in Python, Bash or PowerShell.
- Australian citizenship or permanent residency.

Nice to Have

- Splunk Admin, Power User or ES certification
- CyberArk (PAM) experience
- AWS experience or certification
- Infrastructure-as-code and CI/CD (Terraform, CloudFormation, Ansible, Git pipelines)
- MSSP or consulting background across multiple environments (highly regarded)

What's On Offer

- $140,000 to $150,000 + super
- Remote within Australia
- Splunk depth plus a path into PAM, cloud and DevSecOps
- Experienced senior engineers you'll work alongside
- Real ownership of your work in a large production environment

Engagement Details

- Full-time, permanent role
- Remote within Australia. Sydney-based candidates preferred for occasional team days.
- Occasional out-of-hours work for production change windows
- Must be an Australian citizen or permanent resident. A national police check may be required.

Pay: $140,000.00 – $150,000.00 per year

Benefits:

- Employee mentoring program
- Work from home

Application Question(s):

- Do you have experience with underlying Splunk infrastructure components such as Indexers, Heavy Forwarders, Edge Processors, Search Heads?

Work Authorisation:

- Australia (Required)

Location:

- Sydney NSW (Preferred)

Work Location: Hybrid remote in Sydney NSW

📌 Cyber Security Engineer (Splunk SIEM) (Sydney)
🏢 Kelaru Recruitment
📍 Sydney