Splunk Contract Jobs in London

Splunk contractors are engaged to implement, develop, and optimise the Splunk platform for security information management, IT operations monitoring, and log analytics use cases. Splunk's two primary use cases in the UK enterprise market are SIEM and security analytics within security operations centres, and IT operations and infrastructure monitoring within technology operations teams. Contract engagements involve implementing Splunk Enterprise or Splunk Cloud, developing custom searches and dashboards, building Splunk Enterprise Security correlation searches and notable event management, creating Splunk SOAR playbooks for automated response, managing data onboarding and indexer configuration, and optimising Splunk deployments for performance and licensing cost.

Splunk contractors are expected to have deep, hands-on expertise with the Splunk platform and strong proficiency in SPL (Splunk Processing Language), the query language used for all Splunk search, analysis, and dashboard development. For security-focused roles, experience configuring and tuning Splunk Enterprise Security, developing correlation searches that detect meaningful threat patterns while managing false positive volumes, and building risk-based alerting workflows is the primary technical requirement. For IT operations roles, experience building Splunk dashboards and alerts for infrastructure monitoring, application performance management, and operational intelligence is expected. Knowledge of Splunk architecture components including indexers, search heads, forwarders, and the Splunk Deployment Server for managing distributed environments is expected for roles with platform administration responsibility. Splunk certifications, particularly Splunk Core Certified Power User and the ES and SOAR certifications, are well regarded.

The Splunk contract market is a specialist and active segment within the cybersecurity and IT operations contractor market. Splunk has very deep penetration in the financial services sector, where it has been the dominant SIEM platform for many large banks and insurers, creating a consistent market for Splunk contractors in security operations and compliance use cases. While Microsoft Sentinel is growing rapidly and taking market share for new SIEM implementations, the large installed base of Splunk across existing enterprise customers will generate contractor demand for management, optimisation, and development work for many years. IT operations and observability use cases provide an additional and growing source of Splunk contract demand beyond the security market. Compensation reflects the specialist SPL expertise and platform depth required.

London dominates the UK contractor market by volume, depth, and rate levels. The capital concentrates the headquarters and major offices of most FTSE 100 companies, the largest global banks, the Big Four professional services firms, and the central government departments that collectively generate the majority of UK contract demand. Every contracting discipline covered on this site has active demand in London, from niche specialisms like threat intelligence and LLM engineering through to high-volume disciplines like project management and business analysis. The sheer density of employers means contractors in London typically have more choice of engagement at any given time than anywhere else in the UK. Day rates carry a premium of 15 to 25 per cent over the national average across most disciplines, reflecting both the concentration of complex, high-value programmes and the cost of operating in the capital.

Contract rates for splunk roles in London typically range from £550 to £935 per day, depending on the scope of the role, required expertise, and the delivery expectations of the engagement.

Over the past twelve months, we have tracked over 100 splunk contract roles across the site, with London accounting for roughly one in three of those. Data reviewed up to May 2026.