Automation, CISSP - Certified Information Systems Security Professional, Case Management, Change Control, CompTIA Security+, Continuous Improvement, Data Recovery, Enterprise Protection, GIAC - Global Information Assurance Certification, High Availability, Hunting, Identify Issues, Incident Response, Industry Standards, Information Systems/Technology IS/IT Administration, Information/Data Security (InfoSec), Knowledge Transfer, Linux Operating System, Metrics, Microsoft Windows Operating System, Onboarding, Operational Support, Security Architecture, Security Consulting, Security Information and Event Management (SIEM), Technical Support, Technical Writing, Test Plan/Schedule
SCOPE: THIS POSITION WILL SERVE AS A SIEM ENGINEER WITHIN THE DEPARTMENT OF
ADMINISTRATION'S DIVISION OF INFORMATION SECURITY. THE SUCCESSFUL
CANDIDATE WILL SHOW EXTENSIVE EXPERIENCE SUCCESSFULLY DESIGNING,
IMPLEMENTING, MAINTAINING AND OPTIMIZING PALO ALTO CORTEX XSIAM
AND CORTEX XDR IN LARGE-SCALE, MULTI-TENANT SECURITY
ENVIRONMENTS. THIS CONTRACTOR WILL WORK WITH A LARGE ENTERPRISE SECURITY
TEAM AND A 24X7 SECURITY OPERATIONS CENTER (SOC), ASSISTING FULL-TIME SECURITY
ARCHITECTS, ENGINEERS AND ANALYSTS WITH THE DESIGN, IMPLEMENTATION, INTEGRATION
AND CONTINUOUS IMPROVEMENT OF SIEM, XDR, DETECTION AND RESPONSE CAPABILITIES
SUPPORTING MULTIPLE STATE AGENCIES.
DAILY DUTIES / RESPONSIBILITIES:
THIS POSITION IS 100% REMOTE AND WILL PARTICIPATE IN A MONTHLY ON-
CALL ROTATION SUPPORTING A 24X7 SECURITY OPERATIONS CENTER SERVING
MULTIPLE STATE AGENCIES. OTHER AFTER-HOURS WORK MAY BE REQUIRED
AS NEEDED.
" PRIMARILY ASSIST IN THE PLANNING, DESIGN, DEPLOYMENT, ADMINISTRATION AND
OPERATIONAL SUPPORT OF ENTERPRISE SIEM AND XDR CAPABILITIES, INCLUDING:
PALO ALTO CORTEX XSIAM AND CORTEX XDR PLATFORM
ENGINEERING, CONFIGURATION, OPTIMIZATION AND
TROUBLESHOOTING
MULTI-TENANT AGENCY ONBOARDING, TENANT-SPECIFIC
CONFIGURATION, ROLE-BASED ACCESS, DATA SEGREGATION,
DASHBOARDS AND REPORTING
DETECTION ENGINEERING, CORRELATION RULES, ANALYTICS,
THREAT-HUNTING QUERIES, WATCHLISTS, SUPPRESSION LOGIC
AND FALSE-POSITIVE REDUCTION
" DEVELOP, TEST, DEPLOY AND MAINTAIN AUTOMATED RESPONSE WORKFLOWS AND
PLAYBOOKS FOR ENRICHMENT, TRIAGE, CONTAINMENT, ESCALATION, NOTIFICATIONS,
CASE MANAGEMENT AND INCIDENT RESPONSE.
" CREATE AND MAINTAIN OPERATIONAL RUNBOOKS, STANDARD OPERATING
PROCEDURES, ESCALATION MATRICES, TROUBLESHOOTING GUIDES, ARCHITECTURE
DIAGRAMS, DATA-FLOW DOCUMENTATION, USE-CASE CATALOGS AND ANALYST
KNOWLEDGE ARTICLES.
" SUPPORT TIER 1 THROUGH TIER 3 SOC ANALYSTS AND INCIDENT RESPONDERS
THROUGH PLATFORM TROUBLESHOOTING, DETECTION TUNING, THREAT HUNTING,
TECHNICAL ESCALATION, KNOWLEDGE TRANSFER AND SHIFT HANDOFFS.
" MONITOR AND REPORT ON INGESTION HEALTH, PLATFORM AVAILABILITY, ALERT
VOLUMES, DETECTION COVERAGE, FALSE POSITIVES, SERVICE LEVELS, MEAN TIME TO
DETECT, MEAN TIME TO RESPOND AND TENANT-SPECIFIC OPERATIONAL METRICS.
" ENSURE HIGH AVAILABILITY, RESILIENCE, BACKUP, RECOVERY, LIFECYCLE
MANAGEMENT AND CONTROLLED CHANGE PROCESSES FOR SIEM, XDR AND
SUPPORTING LOG PIPELINE SERVICES.
" COLLABORATE WITH SECURITY ARCHITECTS, ENGINEERS, ANALYSTS AND AGENCY
STAKEHOLDERS TO ALIGN SOLUTIONS WITH BUSINESS GOALS, INDUSTRY-STANDARD
FRAMEWORKS, REGULATORY REQUIREMENTS AND ORGANIZATIONAL RISK
TOLERANCE.
REQUIRED SKILLS (RANK IN ORDER OF
IMPORTANCE):
" HANDS-ON PALO ALTO CORTEX
XSIAM AND CORTEX XDR
DESIGN, IMPLEMENTATION,
ADMINISTRATION AND
OPERATIONAL SUPPORT.
" Experience engineering and
supporting SIEM capabilities for
multi-tenant environments and 24x7
Security Operations Center
operations.
" Experience developing and tuning
detections, correlation rules, analytics,
threat-hunting queries, dashboards,
reporting and alert suppression logic.
" Strong experience creating and
managing complex playbooks
" CRIBL DATA MODELING, LOG
PIPELINE DESIGN, PARSING,
NORMALIZATION,
ENRICHMENT, ROUTING AND
INGESTION.
" Experience developing automation,
integrations, playbooks and response
workflows using scripting languages
such as Python and Bash.
" Experience onboarding and
troubleshooting telemetry from cloud,
endpoint, network, identity, SaaS,
Linux, Windows and custom
application sources.
" Strong understanding of enterprise
security architecture, incident
response, networking, access control,
secure system design and industry-
standard cybersecurity frameworks.
PREFERRED SKILLS (RANK IN ORDER OF
IMPORTANCE):
" HANDS-ON EXPERIENCE
OPERATING CORTEX XSIAM
AND CORTEX XDR IN A LARGE,
MULTI-TENANT
ENVIRONMENT.
" Hands-on Cribl administration, data
modeling and log pipeline
optimization experience.
" Experience supporting Tier 1 through
Tier 3 SOC analysts, threat hunting,
incident response and 24x7
operational handoffs.
" Familiarity with industry-standard
security and compliance frameworks
and experience developing
playbooks, runbooks, procedures and
technical documentation.
REQUIRED EDUCATION/CERTIFICATIONS:
" BACHELOR'S DEGREE IN AN
INFORMATION TECHNOLOGY OR
INFORMATION SECURITY RELATED
FIELD
" EIGHT YEARS OF RELEVANT WORK
EXPERIENCE MAY BE SUBSTITUTED IN
LIEU OF EDUCATION
" FIVE YEARS OF EXPERIENCE IN
SUPPORTING LARGE IT
ENVIRONMENTS AND/OR SYSTEM
DEPLOYMENTS
PREFERRED EDUCATION/CERTIFICATIONS:
" CISSP, Security+ or GIAC
certification
" Palo Alto Cortex, Cribl or other
relevant SIEM/security platform certification