> Markdown version of [/jobs/ext/4600163-senior-siem-engineer](https://www.wearedevelopers.com/jobs/ext/4600163-senior-siem-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior SIEM Engineer

- **Company:** CAI, Inc.
- **Location:** Springfield, IL, United States (Remote available)
- **Experience:** Expert
- **Salary:** $145,600.0 - $166,400.0
- **Contract:** Contract
- **Skills:** Microsoft Windows, ARM Architecture, Bash Shell, Software as a Service, Cloud Computing, CompTIA Security+, Cyber Security, Linux, Intrusion Detection and Prevention, Python (Programming Language), Routing, Parsing, Security Information and Event Management, Systems Integration, Cyber Threat Analysis, Information Technology, Cybercrime, Palo Alto Networks, Enterprise Integration, Security Orchestration, Automation & Response
- **Published:** November 6, 2026
- **Apply:** https://dejobs.org/x/x/14447EA67FB04644B4172C813B220F56/job/

## About the Role

* Hands-on experience designing, implementing, administering, and supporting Palo Alto Cortex XSIAM and Cortex XDR.
 * Experience supporting SIEM platforms within large-scale, multi-tenant environments and 24x7 SOC operations
 * Strong background in detection engineering, threat hunting, correlation rule development, alert tuning, dashboards, and reporting.
 * Experience creating and managing security automation, playbooks, and response workflows
 * Hands-on experience with Cribl, including data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion
 * Experience developing integrations and automation using Python and Bash
 * Experience onboarding and troubleshooting cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application telemetry sources
 * Strong understanding of enterprise security architecture, incident response, networking, access controls, secure system design, and cybersecurity frameworks
 * Bachelor's degree in Information Technology, Information Security, or a related field; equivalent experience may be considered in lieu of a degree
 * Minimum five years of experience supporting large IT environments and/or enterprise system deployments
 * Ability to pass criminal background and credit checks and obtain/maintain CJIS certification

Preferred

 * Preferred certifications such as CISSP, Security+, GIAC, Palo Alto Cortex, Cribl, or other relevant cybersecurity certifications

Physical Demands

 * Ability to safely and successfully perform the essential job functions consistent with the ADA and other federal, state, and local standards
 * Sedentary work that involves sitting or remaining stationary most of the time with occasional need to move around the office to attend meetings, etc
 * Ability to conduct repetitive tasks on a computer, utilizing a mouse, keyboard, and monitor

## Description

The Senior SIEM Engineer will be responsible for designing, implementing, and optimizing Palo Alto Cortex XSIAM/XDR and Cribl solutions in a large-scale, multi-tenant 24x7 SOC environment, with expertise in detection engineering, security automation, threat hunting, log pipeline management, and incident response support., We are seeking a highly skilled and experienced Senior SIEM Engineer to join our IT team. This position will be full-time, remote, and is a contract position.

What You'll Do

 * Design, implement, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR platforms
 * Support enterprise SIEM and XDR operations within a large-scale, multi-tenant security environment
 * Configure tenant onboarding, role-based access controls, data segregation, dashboards, reporting, and platform integrations
 * Develop and tune detection content, correlation rules, analytics, threat-hunting queries, watchlists, and alert suppression logic
 * Design and maintain security automation, playbooks, and incident response workflows
 * Support Cribl log management, including data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion
 * Integrate security platforms with ticketing, case management, notification, identity, and threat intelligence systems
 * Monitor platform health, ingestion performance, alert volumes, detection coverage, and operational metrics
 * Troubleshoot complex security platform issues and support Tier 1-3 SOC analysts during investigations and incident response activities.
 * Create and maintain runbooks, SOPs, architecture diagrams, technical documentation, and knowledge articles
 * Participate in a monthly on-call rotation supporting a 24x7 Security Operations Center (SOC)
 * Collaborate with security architects, engineers, analysts, and stakeholders to continuously improve security operations and services