> Markdown version of [/jobs/ext/4583916-security-architect-consultant-siem](https://www.wearedevelopers.com/jobs/ext/4583916-security-architect-consultant-siem). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Architect - Consultant - SIEM

- **Company:** Resourcesoft, Inc.
- **Location:** United States
- **Experience:** Expert
- **Contract:** Contract
- **Skills:** Microsoft Windows, ARM Architecture, Bash Shell, Software as a Service, Cloud Computing, Linux, Intrusion Detection and Prevention, Python (Programming Language), Parsing, Role-Based Access Control, Security Information and Event Management, Systems Integration, Cyber Threat Analysis, Cybercrime, Security Orchestration, Automation & Response
- **Published:** November 5, 2026
- **Apply:** https://www.dice.com/job-detail/395c3795-79d6-401b-9674-cee46e03b1eb

## About the Role

* 5 years or more of experience engineering enterprise SIEM/XDR platforms and supporting large-scale 24x7 SOC environments.
 * Proficiency in Palo Alto Cortex XSIAM, Cortex XDR, SIEM architecture, detection engineering, administration, and optimization.
 * Experience with Cribl, log pipelines, parsing, normalization, enrichment, routing, ingestion, and security data modeling.
 * Experience with Python, Bash, SOAR automation, playbooks, threat hunting, correlation rules, integrations, and incident response.
 * Experience with cloud, endpoint, network, identity, SaaS, Linux, Windows telemetry, RBAC, multi-tenancy, and security frameworks.
 * Excellent verbal and written communication skills

## Description

* Engineer, configure, optimize, and support enterprise Cortex XSIAM and Cortex XDR capabilities across multi-tenant environments.
 * Build and tune detections, correlation rules, threat-hunting queries, dashboards, alert suppression, and security analytics.
 * Design Cribl pipelines for log routing, parsing, normalization, enrichment, filtering, ingestion, and telemetry onboarding.
 * Develop automated playbooks and workflows for enrichment, triage, containment, escalation, notifications, and case management.
 * Monitor platform health, ingestion, availability, detection coverage, false positives, performance, retention, and operational metrics.
 * Support SOC operations through incident troubleshooting, detection tuning, technical escalation, threat hunting, and operational documentation.