Senior SIEM Engineer

• Design, implement, configure, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR platforms.
• Support multi-tenant agency onboarding, tenant configurations, role-based access controls, and data segregation.
• Develop and tune detection rules, correlation rules, analytics, threat-hunting queries, dashboards, and reporting.
• Design and manage complex automation playbooks for alert triage, enrichment, incident response, containment, and escalation.
• Support Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
• Onboard and troubleshoot telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Optimize log ingestion, retention, performance, and platform costs.
• Develop and maintain runbooks, SOPs, troubleshooting guides, architecture diagrams, and technical documentation.
• Provide Tier 1-Tier 3 SOC support, technical escalations, threat hunting, and incident response assistance.
• Monitor platform health, detection coverage, alert volumes, false positives, and SOC operational metrics.
• Participate in monthly on-call rotations supporting a 24x7 Security Operations Center.

We are seeking an experienced Senior SIEM Engineer with strong hands-on expertise in Palo Alto Cortex XSIAM, Cortex XDR, and Cribl to support enterprise security operations for multiple state agencies.

The ideal candidate will have extensive experience designing, implementing, administering, and optimizing SIEM/XDR platforms in large-scale, multi-tenant environments. The role will primarily focus on Cortex XSIAM/XDR engineering, detection development, automation, and SOC operational support, with secondary responsibilities involving Cribl data pipelines and log management., * Strong hands-on experience with Palo Alto Cortex XSIAM and Cortex XDR engineering, administration, and implementation.

• Experience operating SIEM/XDR platforms in large-scale, multi-tenant enterprise environments.
• Strong knowledge of detection engineering, correlation rules, analytics, threat hunting, and alert tuning.
• Experience developing and managing complex security automation playbooks.
• Hands-on experience with Cribl administration, data modeling, log parsing, normalization, enrichment, and pipeline optimization.
• Scripting experience with Python and Bash.
• Experience integrating cloud, endpoint, network, identity, SaaS, Linux, and Windows security telemetry.
• Strong understanding of enterprise security architecture, incident response, networking, access controls, and cybersecurity frameworks.
• Experience supporting 24x7 SOC operations and Tier 1-Tier 3 security teams., * Bachelor’s degree in Information Technology, Information Security, or a related field.
• 8 years of relevant work experience may be substituted for the educational requirement.
• Minimum 5 years of experience supporting large IT environments and/or system deployments., * CISSP, CompTIA Security+, or GIAC certification.
• Palo Alto Cortex, Cribl, or other relevant SIEM/security platform certifications.
• Experience working with state government or enterprise security environments..

Depends on Experience