Cortex XSIAM SIEM Expert — Sydney Hybrid

NCS Australia; Melbourne; Hybrid; AUD 150,000 - 210,000; Full time

Job summary

NCS Australia is seeking an experienced SIEM Subject Matter Expert with Palo Alto Cortex XSIAM to lead end‑to‑end enterprise SIEM data pipelines for a Sydney based project. The role is hands‑on and involves log source onboarding, parsing, normalization, and enrichment to provide high‑quality context for security analysts.

You will design automation tooling, tune detections, manage platform health and capacity, and collaborate across security operations.

Qualifications

• Hands-on Cortex XSIAM experience in log ingestion and customization.
• Experience with log parsing, data modeling and enrichment.
• Ability to automate onboarding workflows via APIs or scripting.

Responsibilities

• Log Source Onboarding: onboard diverse enterprise log sources, leading parsing, field extraction, data modeling and normalization.
• Automation & Tooling: design, build, and maintain automated onboarding tooling via scripting, APIs, or native capabilities.
• Telemetry Enrichment: manage enrichment pipelines that append context to raw log events for analysts.
• Detection & Alert Tuning: fine-tune SIEM configurations and detection content to reduce false positives and improve signal quality.
• Platform Lifecycle Management: oversee SIEM platform health, performance, capacity, connectors, and upgrades.

Skills

Regex proficiency

Structured log analysis

Telemetry enrichment

Automation scripting

Log source onboarding

Education

Palo Alto Networks PCSAE or Cortex credentials

Tools

Broker VMs

XDR Collectors

XSIAM

Job description

NCS Australia is seeking an experienced SIEM Subject Matter Expert with Palo Alto Cortex XSIAM to lead end‑to‑end enterprise SIEM data pipelines for a Sydney based project. The role is hands‑on and involves log source onboarding, parsing, normalization, and enrichment to provide high‑quality context for security analysts.

You will design automation tooling, tune detections, manage platform health and capacity, and collaborate across security operations.