Senior Cybersecurity SIEM Engineer/Security Architect – W2 Only

Role: Senior Cybersecurity SIEM Engineer/Security Architect – W2 Only

Duration of the Contract: 12 months with possibility of extensions

Work Location: Fully Remote

Interview Process: 1-2 rounds, Virtual/Online

1. Candidate Location

• This is a 100% remote position.
• The candidate must participate in a monthly on-call rotation to support the 24/7 Security Operations Center (SOC).
• Occasional after-hours maintenance, incident support, and shift handoffs may be required.
• Candidates from anywhere in the United States can apply.

2. Scope of the Position

• The candidate will work as a SIEM Engineer for the Department of Administration's Division of Information Security.
• The main responsibility is to design, implement, manage, and improve Palo Alto Cortex XSIAM and Cortex XDR security platforms.
• The candidate will work with a large enterprise security team and a 24/7 SOC team.
• They will help security architects, engineers, and analysts build, maintain, and improve security monitoring, threat detection, and incident response systems.
• The role supports multiple state agencies.

3. Successful Candidate

• The ideal candidate should have strong hands-on experience with:
• Palo Alto Cortex XSIAM and Cortex XDR: Managing, configuring, maintaining, and improving these security platforms.
• Cribl: Supporting log management, collecting data, processing logs, and sending security data to the right systems.
• Multi-tenant environments: Setting up different state agencies with separate configurations, access, and security data.
• Security Operations: Supporting threat detection, threat hunting, incident response, dashboards, and reporting.
• Automation: Creating automated workflows and security response processes.
• Documentation: Preparing technical documents, troubleshooting guides, procedures, and training materials.
• Technical Support: Helping SOC analysts troubleshoot issues and improve security operations.
• The candidate should also be able to design solutions, solve technical problems, improve system performance, and continuously enhance security operations.

4. Mandatory Screening Requirements

• Candidates must successfully pass a full credit check.
• Candidates must successfully pass a criminal background check during the initial hiring process.
• After joining, candidates must obtain and maintain annual CJIS certification.
• Candidates who cannot meet these requirements will not be considered for employment.

Daily Duties and Responsibilities

A. Palo Alto Cortex XSIAM and XDR – Primary Responsibility

• Design, configure, implement, manage, and troubleshoot Palo Alto Cortex XSIAM and Cortex XDR.
• Set up different state agencies on the platform with separate access, configurations, dashboards, and reports.
• Create and improve security detection rules to identify suspicious activities and threats.
• Perform threat hunting and reduce false security alerts.

B. Cribl and Log Management – Secondary Responsibility

• Support Cribl for collecting, processing, managing, and routing security logs.
• Configure log parsing, filtering, normalization, and data enrichment.
• Connect and monitor logs from cloud systems, computers, networks, identity systems, SaaS applications, and other sources.
• Manage log storage, volume, performance, and costs while maintaining security requirements.

C. Security Integrations and Automation

• Integrate security platforms with ticketing systems, case management tools, identity systems, and threat intelligence tools.
• Develop and maintain automated security response workflows.
• Automate activities such as threat investigation, incident escalation, notifications, and security response.

D. Documentation and Procedures

Create and maintain technical documentation, including:

• Operational procedures and runbooks.
• Troubleshooting guides.
• Security escalation procedures.
• System architecture diagrams.
• Data flow documentation.
• Security use cases and knowledge articles.

E. SOC Team Support

• Provide technical support to Tier 1, Tier 2, and Tier 3 SOC analysts.
• Help analysts troubleshoot security platform issues.
• Support threat hunting, detection improvements, and incident investigations.
• Share technical knowledge and assist with shift handoffs.

F. Monitoring and Reporting

• Monitor security platform performance and availability.
• Track log collection, security alerts, and detection coverage.
• Identify and reduce false-positive alerts.
• Monitor security response times and system performance.
• Prepare operational reports for different state agencies.
• G. Platform Maintenance and Security
• Ensure security platforms are available and working properly.
• Support backups, recovery, system updates, and maintenance.
• Follow proper change management procedures.
• Improve system reliability and performance.

H. Team Collaboration

• Work closely with security architects, engineers, SOC analysts, and state agency teams.
• Understand business and security requirements.
• Ensure all security solutions follow industry standards, government regulations, and organizational security policies.

Required Skills:

• Bachelor's Degree in an Information Technology or Information Security related field; 8+ years of relevant work may be substituted in lieu of education
• 5+ years of experience in supporting large IT environments and/or system deployments
• Palo Alo Cortex XSIAM and Cortex XDR Design, implementation, administration, and operational support
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations
• CRIBL Data Modeling, Log Pipeline Design, Parsing, Normalization, Enrichment, Routing and Ingestion experience
• Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources
• Enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks

Preferred Skills:

• CISSP, Security+ or GIAC certification
• Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification