Role: Senior Cybersecurity SIEM Engineer/Security Architect – W2 Only
Duration of the Contract: 12 months with possibility of extensions
Work Location: Fully Remote
Interview Process: 1-2 rounds, Virtual/Online
1. Candidate Location
- This is a 100% remote position.
- The candidate must participate in a monthly on-call rotation to support the 24/7 Security Operations Center (SOC).
- Occasional after-hours maintenance, incident support, and shift handoffs may be required.
- Candidates from anywhere in the United States can apply.
2. Scope of the Position
- The candidate will work as a SIEM Engineer for the Department of Administration's Division of Information Security.
- The main responsibility is to design, implement, manage, and improve Palo Alto Cortex XSIAM and Cortex XDR security platforms.
- The candidate will work with a large enterprise security team and a 24/7 SOC team.
- They will help security architects, engineers, and analysts build, maintain, and improve security monitoring, threat detection, and incident response systems.
- The role supports multiple state agencies.
3. Successful Candidate
- The ideal candidate should have strong hands-on experience with:
- Palo Alto Cortex XSIAM and Cortex XDR: Managing, configuring, maintaining, and improving these security platforms.
- Cribl: Supporting log management, collecting data, processing logs, and sending security data to the right systems.
- Multi-tenant environments: Setting up different state agencies with separate configurations, access, and security data.
- Security Operations: Supporting threat detection, threat hunting, incident response, dashboards, and reporting.
- Automation: Creating automated workflows and security response processes.
- Documentation: Preparing technical documents, troubleshooting guides, procedures, and training materials.
- Technical Support: Helping SOC analysts troubleshoot issues and improve security operations.
- The candidate should also be able to design solutions, solve technical problems, improve system performance, and continuously enhance security operations.
4. Mandatory Screening Requirements
- Candidates must successfully pass a full credit check.
- Candidates must successfully pass a criminal background check during the initial hiring process.
- After joining, candidates must obtain and maintain annual CJIS certification.
- Candidates who cannot meet these requirements will not be considered for employment.
Daily Duties and Responsibilities
A. Palo Alto Cortex XSIAM and XDR – Primary Responsibility
- Design, configure, implement, manage, and troubleshoot Palo Alto Cortex XSIAM and Cortex XDR.
- Set up different state agencies on the platform with separate access, configurations, dashboards, and reports.
- Create and improve security detection rules to identify suspicious activities and threats.
- Perform threat hunting and reduce false security alerts.
B. Cribl and Log Management – Secondary Responsibility
- Support Cribl for collecting, processing, managing, and routing security logs.
- Configure log parsing, filtering, normalization, and data enrichment.
- Connect and monitor logs from cloud systems, computers, networks, identity systems, SaaS applications, and other sources.
- Manage log storage, volume, performance, and costs while maintaining security requirements.
C. Security Integrations and Automation
- Integrate security platforms with ticketing systems, case management tools, identity systems, and threat intelligence tools.
- Develop and maintain automated security response workflows.
- Automate activities such as threat investigation, incident escalation, notifications, and security response.
D. Documentation and Procedures
Create and maintain technical documentation, including:
- Operational procedures and runbooks.
- Troubleshooting guides.
- Security escalation procedures.
- System architecture diagrams.
- Data flow documentation.
- Security use cases and knowledge articles.
E. SOC Team Support
- Provide technical support to Tier 1, Tier 2, and Tier 3 SOC analysts.
- Help analysts troubleshoot security platform issues.
- Support threat hunting, detection improvements, and incident investigations.
- Share technical knowledge and assist with shift handoffs.
F. Monitoring and Reporting
- Monitor security platform performance and availability.
- Track log collection, security alerts, and detection coverage.
- Identify and reduce false-positive alerts.
- Monitor security response times and system performance.
- Prepare operational reports for different state agencies.
- G. Platform Maintenance and Security
- Ensure security platforms are available and working properly.
- Support backups, recovery, system updates, and maintenance.
- Follow proper change management procedures.
- Improve system reliability and performance.
H. Team Collaboration
- Work closely with security architects, engineers, SOC analysts, and state agency teams.
- Understand business and security requirements.
- Ensure all security solutions follow industry standards, government regulations, and organizational security policies.
Required Skills:
- Bachelor's Degree in an Information Technology or Information Security related field; 8+ years of relevant work may be substituted in lieu of education
- 5+ years of experience in supporting large IT environments and/or system deployments
- Palo Alo Cortex XSIAM and Cortex XDR Design, implementation, administration, and operational support
- Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations
- CRIBL Data Modeling, Log Pipeline Design, Parsing, Normalization, Enrichment, Routing and Ingestion experience
- Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash
- Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources
- Enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks
Preferred Skills:
- CISSP, Security+ or GIAC certification
- Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification
