Job Title: Senior SIEM Engineer – Palo Alto Cortex XSIAM / XDR

Work Location: 100% Remote
Candidate Location: Open to Nationwide
Work Schedule: Monthly On-Call Rotation (24x7 SOC Support)

Job Description

We are seeking an experienced Senior SIEM Engineer with strong hands-on expertise in Palo Alto Cortex XSIAM, Cortex XDR, and Cribl to support enterprise security operations for multiple state agencies.

The ideal candidate will have extensive experience designing, implementing, administering, and optimizing SIEM/XDR platforms in large-scale, multi-tenant environments. The role will primarily focus on Cortex XSIAM/XDR engineering, detection development, automation, and SOC operational support, with secondary responsibilities involving Cribl data pipelines and log management.

Key Responsibilities

• Design, implement, configure, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR platforms.

• Support multi-tenant agency onboarding, tenant configurations, role-based access controls, and data segregation.

• Develop and tune detection rules, correlation rules, analytics, threat-hunting queries, dashboards, and reporting.

• Design and manage complex automation playbooks for alert triage, enrichment, incident response, containment, and escalation.

• Support Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.

• Onboard and troubleshoot telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.

• Optimize log ingestion, retention, performance, and platform costs.

• Develop and maintain runbooks, SOPs, troubleshooting guides, architecture diagrams, and technical documentation.

• Provide Tier 1–Tier 3 SOC support, technical escalations, threat hunting, and incident response assistance.

• Monitor platform health, detection coverage, alert volumes, false positives, and SOC operational metrics.

• Participate in monthly on-call rotations supporting a 24x7 Security Operations Center.

Required Skills

• Strong hands-on experience with Palo Alto Cortex XSIAM and Cortex XDR engineering, administration, and implementation.

• Experience operating SIEM/XDR platforms in large-scale, multi-tenant enterprise environments.

• Strong knowledge of detection engineering, correlation rules, analytics, threat hunting, and alert tuning.

• Experience developing and managing complex security automation playbooks.

• Hands-on experience with Cribl administration, data modeling, log parsing, normalization, enrichment, and pipeline optimization.

• Scripting experience with Python and Bash.

• Experience integrating cloud, endpoint, network, identity, SaaS, Linux, and Windows security telemetry.

• Strong understanding of enterprise security architecture, incident response, networking, access controls, and cybersecurity frameworks.

• Experience supporting 24x7 SOC operations and Tier 1–Tier 3 security teams.

Education & Experience

• Bachelor's degree in Information Technology, Information Security, or a related field.

• 8 years of relevant work experience may be substituted for the educational requirement.

• Minimum 5 years of experience supporting large IT environments and/or system deployments.

Preferred Qualifications

• CISSP, CompTIA Security+, or GIAC certification.

• Palo Alto Cortex, Cribl, or other relevant SIEM/security platform certifications.

• Experience working with state government or enterprise security environments..