SIEM Engineer

Required Skills

• Bachelor's Degree in Information Technology, Information Security, or a related field; 8+ years of relevant work experience may be substituted in lieu of education.
• 5+ years of experience supporting large IT environments and/or system deployments.
• Hands-on experience with Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, configuration, optimization, troubleshooting, and operational support.
• Experience engineering and supporting SIEM capabilities in large-scale, multi-tenant environments and 24x7 SOC operations.
• Hands-on experience with Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
• Experience developing automation, integrations, complex playbooks, and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks.

Preferred Skills

• CISSP, Security+, or GIAC certification.
• Palo Alto Cortex, Cribl, or other relevant SIEM/security platform certification.

Key Responsibilities

• Design, deploy, administer, optimize, and troubleshoot Palo Alto Cortex XSIAM and Cortex XDR platforms.
• Support multi-tenant agency onboarding, tenant-specific configurations, role-based access controls, data segregation, dashboards, and reporting.
• Develop and tune detection rules, correlation logic, security analytics, threat-hunting queries, watchlists, and alert suppression mechanisms to reduce false positives.
• Design and maintain Cribl log pipelines, including data modeling, routing, parsing, normalization, enrichment, filtering, replay, and ingestion.
• Onboard, integrate, and monitor security telemetry across cloud, endpoint, network, identity, SaaS, and enterprise application environments.
• Optimize log ingestion volumes, retention, performance, and cost while maintaining security and compliance requirements.
• Integrate SIEM/XDR platforms with ticketing, case management, notification, identity, threat intelligence, and other enterprise systems.
• Develop and maintain automated response playbooks for enrichment, triage, containment, escalation, notification, case management, and incident response.
• Create and maintain technical documentation, including runbooks, SOPs, escalation procedures, architecture diagrams, data-flow documentation, and troubleshooting guides.
• Provide technical support to Tier 1, Tier 2, and Tier 3 SOC analysts, including detection tuning, threat hunting, incident response, troubleshooting, and operational handoffs.
• Monitor platform availability, ingestion health, detection coverage, false positives, service levels, Mean Time to Detect (MTTD), and Mean Time to Respond (MTTR).
• Ensure high availability, resilience, backup, recovery, lifecycle management, and controlled change processes for SIEM, XDR, and supporting log pipeline services.
• Collaborate with security architects, engineers, analysts, and agency stakeholders to ensure alignment with cybersecurity frameworks, regulatory requirements, and organizational security objectives.