Security Architect – Consultant / SIEM Engineer

Security Architect – Consultant / SIEM Engineer

Location: 100% Remote; open to candidates nationwide
Duration: 12 months, with possible extension
Interview Process: 1–2 virtual rounds
Schedule: Monthly on-call rotation supporting a 24×7 SOC; additional after-hours support as needed

Position Overview

The client seeks an experienced SIEM Engineer to design, implement, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR within a large, multi-tenant security environment supporting multiple state agencies.

The primary focus is Cortex platform engineering, detection development, automation, and SOC operational support. The role also provides secondary support for Cribl administration, security data modeling, and log pipeline engineering.

Key Responsibilities

• Design, configure, deploy, administer, troubleshoot, and optimize Cortex XSIAM and Cortex XDR.
• Onboard agencies into a multi-tenant environment, maintaining tenant-specific configurations, role-based access, data segregation, dashboards, and reporting.
• Develop and tune detection rules, correlation logic, analytics, threat-hunting queries, watchlists, and alert suppression to reduce false positives.
• Engineer Cribl pipelines for log parsing, normalization, enrichment, filtering, routing, replay, and ingestion.
• Onboard and monitor telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Optimize log volumes, retention, platform performance, and ingestion costs while meeting security and compliance requirements.
• Develop and maintain automated response workflows and complex playbooks for enrichment, triage, containment, escalation, notification, and incident response.
• Integrate security platforms with ticketing, case management, identity, threat intelligence, notification, and other enterprise systems.
• Support Tier 1–3 SOC analysts through troubleshooting, detection tuning, threat hunting, incident escalation, knowledge transfer, and shift handoffs.
• Maintain runbooks, standard operating procedures, escalation matrices, architecture diagrams, data-flow documentation, and analyst knowledge articles.
• Monitor platform availability, ingestion health, detection coverage, alert volumes, false positives, service levels, and response metrics.
• Support high availability, resilience, backup, recovery, lifecycle management, and controlled changes.
• Collaborate with security teams and agency stakeholders on architecture, implementation, regulatory requirements, and continuous improvement.

Required Skills and Experience

• Hands-on experience designing, implementing, administering, and supporting Palo Alto Cortex XSIAM and Cortex XDR.
• Experience operating Cortex platforms in large, multi-tenant environments supporting a 24×7 SOC.
• Experience with detection engineering, correlation rules, analytics, threat-hunting queries, dashboards, reporting, and alert suppression.
• Strong experience creating and managing complex security playbooks.
• Hands-on Cribl administration, data modeling, log pipeline design, and optimization experience.
• Experience with log parsing, normalization, enrichment, routing, and ingestion.
• Experience developing automation, integrations, and response workflows using Python, Bash, or similar scripting languages.
• Experience onboarding and troubleshooting diverse security telemetry sources.
• Strong understanding of enterprise security architecture, incident response, networking, access controls, and secure system design.
• Familiarity with industry-standard cybersecurity and compliance frameworks.
• Experience supporting SOC analysts, incident responders, and operational handoffs.
• Strong technical documentation and troubleshooting skills.
• At least 5 years of experience supporting large IT environments and/or system deployments.

Education

• Bachelor’s degree in Information Technology, Information Security, or a related field.
• Eight years of relevant work experience may substitute for the education requirement.

Certifications Listed

• CISSP, CompTIA Security+, or GIAC certification.
• Palo Alto Cortex, Cribl, or another relevant SIEM/security platform certification.