Senior SIEM & Automation Engineer

We are seeking a seasoned SIEM Engineer to drive the architecture, optimization, and automation of a multi-tenant 24x7 Security Operations Center (SOC). This role focuses heavily on Palo Alto Cortex solutions and modern log pipeline engineering.

• Work Arrangement: 100% Remote (Nationwide candidate's welcome; preference for those local to Columbia, SC for occasional onsite activities).
• Location: Columbia, South Carolina
• Interview Process: 1-2 Rounds of Virtual Interviews
• Special Requirement: Must pass a comprehensive criminal background check, credit history check, drug screen, and obtain annual CJIS Certification post-hire.

The Core Focus (What You'll Do Daily)

• Primary: Design, deploy, and optimize Palo Alto Cortex XSIAM & Cortex XDR across multi-tenant environments.
• Secondary: Build and optimize log pipelines, data modeling, routing, and parsing using Cribl.
• Automation: Code response workflows and playbooks using Python and Bash.
• SOC Support: Build correlation rules, threat-hunting queries, and support Tier 1 3 analysts. Participate in a monthly 24x7 on-call rotation.

Key Skills We're Looking For

Must-Have Technical Expertise:

• Palo Alto Cortex XSIAM / XDR: Advanced hands-on implementation and administration.
• SIEM & SOC Operations: Experience engineering SIEM platforms within large-scale, multi-tenant environments.
• Cribl Log Pipelines: Strong grasp of data modeling, parsing, normalization, and routing.
• Scripting: Automation experience using Python and Bash.
• Detection Engineering: Creating watchlists, correlation rules, and alert suppression logic.
• Telemetry Ingestion: Onboarding data from Cloud, SaaS, Endpoint, Identity, Windows, and Linux sources.

Highly Desired (Stand Out from the Crowd):

• Operating Cortex XSIAM/XDR inside massive multi-tenant spaces.
• Advanced Cribl deployment and cost-optimization experience.
• Active certifications like CISSP, Security+, GIAC, or native Palo Alto/Cribl certs.

Education & Experience Requirements

• Bachelor's degree in IT/Cybersecurity OR 8 years of equivalent work experience.
• Minimum of 5 years supporting large IT environments and/or enterprise system deployments.