Job Description

Posted 2 hours ago

SPLUNK Enterprise and ITSI Expert
Location: 3 days on site in either Sheffield/Birmingham/London
Duration: 30/11/2026
Rate £529

MUST BE PAYE THROUGH UMBRELLA
"Key Responsibilities

Design, deploy, and operate Splunk Enterprise and ITSI for hybrid Kubernetes/OpenShift environments.
Onboard data at scale (HEC, Universal Forwarder/Deployment Server), align to CIM, and enforce RBAC, retention, and cost guardrails.
Build ITSI service decompositions, KPIs/multi-KPI thresholds, NEAP policies, glass tables, deep dives, and service health scoring.
Create OpenShift-focused exec/ops views: cluster health (API/etcd), node readiness/pressure, pod restart hotspots, network/storage errors, capacity and quota/bursting visibility.
Tune search and platform performance: workload rules, concurrency, DMA, summary indexing, and scheduling hygiene.
Implement alerting, enrichment, routing to ITSM/ChatOps, suppression windows, maintenance schedules, and runbook automation.
Govern ingest and security: allow/deny lists, PII handling, TLS, token governance, index/role mapping, and data quality SLAs.
Integrate upstream sources and pipelines: OpenTelemetry, Prometheus exporters, Fluentd/Fluent Bit/Vector, Kafka, CMDB/ITSM enrichments, AIOps/ML anomaly detection.Required Skills

Splunk Enterprise: SPL mastery, CIM alignment, KV/lookups/macros, saved searches, index/retention/RBAC design, search performance tuning.
Splunk ITSI: Service trees, KPIs, adaptive/time-based thresholds, NEAP tuning, glass tables, deep dives, Service Analyzer configuration.
OpenShift/Kubernetes observability: Cluster/control-plane metrics, kube events/logs, workload/node/network/storage correlation, capacity and noisy-neighbor detection.
Data pipelines & collectors: OpenTelemetry (OTLP), Prometheus scraping, Fluentd/Fluent Bit/Vector, Kafka (TLS), HEC/UF/DS onboarding.
Reliability & SLOs: Golden signals, rollout/rollback health checks, SLO/KPI mapping to namespaces/apps, executive and ops dashboards.
Performance & cost optimization: Workload rules, DMA, summary indexing, schedule optimization, license/cost guardrails.
Security & compliance: TLS/mTLS, token and cert hygiene, PII controls, auditability, role/index mappings.
Automation & integrations: ITSM/ChatOps routing, runbooks, CMDB enrichment, webhook/AIOps integrations