Job Title: SIEM Engineer – Palo Alto Cortex XSIAM/XDR
Location: 100% Remote – Open to candidates nationwide (USA)
Educational Qualification: Bachelor’s degree in Information Technology, Information Security, or a related field. Eight years of relevant work experience may substitute for a degree.
Position Type: Contract – 12 Months (Possibility of Extension)
Interview Process: 1–2 Virtual/Online Rounds
Must Have Skills:
- 5+ years of experience supporting large-scale IT environments and enterprise system deployments.
- Hands-on experience designing, implementing, administering, optimizing, and troubleshooting Palo Alto Cortex XSIAM and Cortex XDR.
- Strong experience operating SIEM and XDR platforms in large-scale, multi-tenant environments supporting 24x7 Security Operations Centers (SOC).
- Expertise in detection engineering, correlation rules, security analytics, threat-hunting queries, alert tuning, and false-positive reduction.
- Strong experience developing, managing, and optimizing complex security automation playbooks and incident response workflows.
- Hands-on experience with Cribl administration, data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
- Experience configuring multi-tenant environments, role-based access controls (RBAC), data segregation, dashboards, and reporting.
- Proficiency in Python and Bash scripting for security automation, integrations, and response workflows.
- Experience onboarding and troubleshooting security telemetry from cloud, endpoint, network, identity, SaaS, Windows, Linux, and custom applications.
- Strong understanding of enterprise security architecture, incident response, networking, access controls, and cybersecurity frameworks.
- Experience supporting Tier 1–Tier 3 SOC analysts, incident response operations, threat hunting, and technical escalations.
- Ability to pass mandatory credit and criminal background checks and obtain and maintain annual CJIS certification.
Desired Skills:
- CISSP, CompTIA Security+, GIAC, Palo Alto Cortex, Cribl, or other relevant cybersecurity certifications.
- Experience optimizing log ingestion, retention, platform performance, and operational costs.
- Knowledge of SIEM/XDR integrations with ticketing, case management, identity, notification, and threat intelligence platforms.
- Experience developing SOC runbooks, standard operating procedures (SOPs), escalation matrices, and technical documentation.
- Familiarity with security compliance frameworks, regulatory requirements, and risk management practices.
- Experience monitoring SOC performance metrics, including Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), detection coverage, and alert volumes.
- Knowledge of high availability, disaster recovery, backup, lifecycle management, and change management processes.
Job Responsibilities:
- Design, deploy, configure, administer, maintain, and optimize Palo Alto Cortex XSIAM and Cortex XDR across large-scale, multi-tenant security environments.
- Support enterprise SIEM/XDR engineering and 24x7 SOC operations serving multiple state agencies.
- Implement tenant-specific configurations, role-based access controls, data segregation, dashboards, and security reporting.
- Develop and optimize detection rules, correlation logic, analytics, threat-hunting queries, watchlists, and alert suppression mechanisms.
- Design, implement, and maintain Cribl log pipelines, including data modeling, routing, parsing, normalization, enrichment, filtering, and ingestion.
- Onboard, integrate, and troubleshoot security telemetry from cloud, endpoint, network, identity, SaaS, and custom application sources.
- Develop, test, deploy, and maintain automated security response playbooks for alert enrichment, triage, containment, escalation, notifications, and incident management.
- Integrate SIEM/XDR solutions with enterprise ticketing, case management, identity, and threat intelligence systems.
- Support Tier 1–Tier 3 SOC analysts with detection tuning, platform troubleshooting, threat hunting, incident response, and technical escalations.
- Monitor platform health, log ingestion, alert volumes, detection effectiveness, false positives, and operational performance metrics.
- Optimize log retention, ingestion performance, resource utilization, and costs while maintaining security and compliance standards.
- Maintain operational runbooks, SOPs, troubleshooting guides, architecture diagrams, data-flow documentation, and analyst knowledge articles.
- Ensure platform availability, resilience, backup, recovery, and controlled change management for SIEM/XDR infrastructure.
- Collaborate with security architects, engineers, analysts, and agency stakeholders to improve enterprise security capabilities.
- Participate in a monthly on-call rotation supporting the 24x7 SOC, including after-hours maintenance, incident escalation, and operational handoffs as required.