Cortex XSIAM & XDR Engineer / SIEM Architect

Job Title: Senior SIEM Engineer (Palo Alto Cortex XSIAM/XDR)

Overview / Summary

The SIEM Engineer will support the Department of Administration's Division of Information Security by designing, implementing, maintaining, and optimizing Palo Alto Cortex XSIAM and Cortex XDR in a large-scale, multi-tenant security environment. This role works closely with a large enterprise security team and a 24x7 Security Operations Center (SOC) to enhance SIEM, XDR, detection, response, and log management capabilities supporting multiple state agencies.

Key Responsibilities

• Plan, design, deploy, administer, and support Palo Alto Cortex XSIAM and Cortex XDR platforms.
• Configure, optimize, troubleshoot, and maintain enterprise SIEM and XDR capabilities.
• Support multi-tenant agency onboarding, tenant-specific configurations, role-based access controls, data segregation, dashboards, and reporting.
• Develop and tune detections, correlation rules, analytics, threat-hunting queries, watchlists, suppression logic, and false-positive reduction.
• Assist with Cribl data modeling, log pipeline design, routing, parsing, normalization, enrichment, filtering, replay, and ingestion.
• Support onboarding and health monitoring of cloud, endpoint, network, identity, SaaS, and custom application telemetry.
• Optimize log volume, retention, performance, and cost while maintaining security and compliance requirements.
• Develop, test, deploy, and maintain automated response workflows and playbooks for enrichment, triage, containment, escalation, notifications, case management, and incident response.
• Create and maintain runbooks, standard operating procedures, escalation matrices, troubleshooting guides, architecture diagrams, data-flow documentation, use-case catalogs, and analyst knowledge articles.
• Support Tier 1 through Tier 3 SOC analysts through platform troubleshooting, detection tuning, threat hunting, technical escalation, knowledge transfer, and shift handoffs.
• Monitor and report on ingestion health, platform availability, alert volumes, detection coverage, false positives, service levels, mean time to detect, mean time to respond, and tenant-specific operational metrics.
• Ensure high availability, resilience, backup, recovery, lifecycle management, and controlled change processes for SIEM, XDR, and supporting log pipeline services.
• Collaborate with security architects, engineers, analysts, and agency stakeholders to align solutions with business goals, industry-standard frameworks, regulatory requirements, and organizational risk tolerance.
• Participate in a monthly on-call rotation supporting the 24x7 SOC.

Required Qualifications

• Hands-on experience with Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, and operational support.
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations.
• Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting, and alert suppression logic.
• Strong experience creating and managing complex playbooks.
• Experience with Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
• Experience developing automation, integrations, playbooks, and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks.
• Bachelor's degree in Information Technology, Information Security, or a related field; eight years of relevant work experience may be substituted in lieu of education.
• Five years of experience supporting large IT environments and/or system deployments.
• Must successfully pass:
  • Full credit check
  • Criminal background check
  • 7-year background check and credit history check
  • Driving record (MVR)
  • 10-panel drug screen
  • E-Verify
  • SLED check
• Must obtain and maintain annual CJIS certification.

#LI-SK9 #LI-Remote #Hiring