Change Order Management, Continuous Improvement, Data Management, Data Modeling, Data Recovery, High Availability, Identify Issues, Incident Management, Incident Response, Leadership, Metrics, Operational Improvement, Performance Tuning/Optimization, Reporting Dashboards, Scripting (Scripting Languages), Security Architecture, Security Information and Event Management (SIEM), Standard Operating Procedures (SOP)
Hansen Talent Group is seeking a SIEM Engineer with strong experience supporting and utilizing Palo Alto Cortex platforms. This role will work directly with senior leadership as part of a large security focused initiative, working to implement new SIEM tools and optimize security operations!
The SIEM Engineer will be responsible for serving as the SME for the Palo Alto Cortex, supporting the design, implementation, and optimization of the platform as well as supporting continuous improvement efforts for SIEM and incident response efforts.
Duties:
- Implement, configure, optimize, and troubleshoot the Palo Alto Cortex XSIAM and XDR platforms across multiple lines of business, working closely with architects, security engineers, and executive stakeholders.
- Partner with each LOB's SOC and security teams to support the customization of the platform and reporting dashboards, considering needs for data segregation, detection engineering, threat-hurting queries, suppression logic, and false-postive reduction.
- Collaborate with the SOC architects to design and develop runbooks, SOPs, and workflows to optimize the SIEM environment.
- Develop automate workflows and playbooks for incident management (identification, reporting, response, remediation, and escalations).
- Plan, design, and develop security data pipelines using CRIBL data models to optimize log and overall health monitoring
- Monitor the health of the platform, providing support to Tier I-III SIEM analysts and performing performance tuning to improve operations.
- Monitor and report on ingestion health, alert volumes, detection coverage, false positives, service levels, detection times and response times base on LOB operational success metrics.
- Ensure high availability, resilience, backup/recovery of the platform, change requests/management of the platform.
Qualifications:- Hands-on experience with Palo Alto Cortex
- In-depth knowledge of SIEM tools
- scripting experience