Job Title: SIEM Engineer (Cortex XSIAM / XDR), Security Architect Consultant. 100% Remote
Employment Type: Contract, [W2 / 1099]
Location: Remote (US)
Duration: [12 months, possible extension]
Work Authorization: / no sponsorship
About the Role
We’re hiring an experienced SIEM Engineer for a new role with a state government client’s Department of Administration, Division of Information Security (DIS). You’ll join a large enterprise security team and a 24x7 Security Operations Center that protects multiple state agencies. You’ll work with full-time security architects, engineers, and analysts to design, build, and improve SIEM, XDR, and detection-and-response capabilities.
The role centers on Palo Alto Cortex XSIAM and Cortex XDR: engineering, administration, detection content, automation, and operational support. You’ll also provide secondary support for Cribl data modeling and log pipelines. It’s a hands-on job that spans security engineering and SOC operations in a large, multi-tenant environment.
What You’ll Do
Primary: Cortex XSIAM / XDR engineering
- Plan, design, deploy, configure, optimize, and troubleshoot Cortex XSIAM and Cortex XDR.
- Onboard agencies in a multi-tenant environment, including tenant-specific configuration, role-based access, data segregation, dashboards, and reporting.
- Build and tune detections, correlation rules, analytics, threat-hunting queries, watchlists, and suppression logic to reduce false positives.
Secondary: Log management and data pipelines
- Design Cribl data models and pipelines, covering routing, parsing, normalization, enrichment, filtering, replay, and ingestion.
- Onboard and monitor telemetry from cloud, endpoint, network, identity, SaaS, and custom application sources.
- Optimize log volume, retention, performance, and cost while meeting security and compliance requirements.
- Integrate with ticketing, case management, notification, identity, and threat intelligence systems.
Automation, operations, and enablement
- Develop, test, and maintain automated response playbooks for enrichment, triage, containment, escalation, notifications, and case management.
- Write and maintain runbooks, SOPs, escalation matrices, troubleshooting guides, architecture and data-flow diagrams, use-case catalogs, and knowledge articles.
- Support Tier 1–3 SOC analysts and incident responders with escalations, detection tuning, threat hunting, knowledge transfer, and shift handoffs.
- Report on ingestion health, platform availability, alert volumes, detection coverage, false positives, SLAs, MTTD/MTTR, and tenant-level metrics.
- Keep SIEM, XDR, and pipeline services highly available and resilient, with backup, recovery, lifecycle management, and controlled change.
- Work with architects, engineers, and agency stakeholders to align solutions with business goals, industry frameworks, regulatory requirements, and risk tolerance.
Required Skills (in order of importance)
- Hands-on design, implementation, administration, and operational support of Palo Alto Cortex XSIAM and Cortex XDR.
- Experience engineering SIEM capabilities for multi-tenant environments and 24x7 SOC operations.
- Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
- Automation, integrations, and playbook development using Python and Bash.
- Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
- Strong grasp of enterprise security architecture, incident response, networking, access control, secure system design, and cybersecurity frameworks.
Additional Skills
- Developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reports, and alert suppression.
- Building and managing complex playbooks.
- Familiarity with security and compliance frameworks, and experience writing runbooks, procedures, and technical documentation.
- Supporting Tier 1–3 SOC analysts, threat hunting, incident response, and 24x7 handoffs.
Education and Experience
- Bachelor’s degree in IT, Information Security, or a related field. Eight years of relevant experience may substitute for the degree.
- At least 5 years supporting large IT environments and/or system deployments.
Preferred Certifications
- CISSP, Security+, or a GIAC certification.
- Palo Alto Cortex, Cribl, or another relevant SIEM/security platform certification.
Schedule
- 100% remote.
- Monthly on-call rotation supporting the 24x7 SOC.
- After-hours maintenance, incident escalation support, and operational handoffs as needed.
Mandatory Screening (no exceptions)
Candidates must pass all of the following before starting:
- 7-year background check and credit history check
- Driving record (MVR)
- 10-panel drug screen
- E-Verify
- SLED check
After onboarding, you must obtain and keep an annual CJIS certification.
