Professional Services Consultant - Cortex XSIAM

Palo Alto Networks; Canberra; On-site; AUD 180,000 - 240,000; Full time

Job summary

Palo Alto Networks in Australia is seeking an experienced professional to drive the deployment and automation of the Cortex platform for ANZ clients. You will modernize SOC operations and enable customers to transition from legacy tools to an AI-driven threat detection and response framework.

You will lead hands-on deployments, knowledge transfer, and collaborate with engineers and stakeholders to deliver secure, scalable outcomes.

Qualifications

• Deep understanding of modern SOC processes, Incident Response workflows, and the consolidation of SIEM, SOAR, and EDR/XDR.
• Experience crafting custom correlation rules and identifying IOCs/BIOCs.
• Hands-on experience with data engineering, log ingestion, building custom parsers, and mapping data sources to normalized models.
• Proficiency in automation scripting and building custom API integrations to streamline incident triage and remediation.

Responsibilities

• Drive the deployment, configuration, and operationalization of the Cortex platform for clients across the ANZ region.
• Guide customers through SOC modernization and transition from legacy solutions to an AI-driven platform.
• Remotely deploy Cortex XSIAM tenants, configure Broker VMs, and set up automation engines.
• Lead workshops to map use cases to actionable rules and analytics.
• Deliver knowledge transfer and ensure customer teams can operate the platform independently.

Skills

SOC processes

Incident Response

Automation scripting

API integrations

Data engineering

Log ingestion

Parsers & mappings

Python

Consultative design discussions

MSSP / consulting experience

Tools

Python

APIs

Job description

Our Mission

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting‑edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Our Mission

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real‑world problems with cutting‑edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Who We Are

In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real‑world problems and ideating beside the best and the brightest, we invite you to join us! We believe collaboration thrives in person. That’s why most of our teams work from the office full time, with flexibility when it’s needed. This model supports real‑time problem‑solving, stronger relationships, and the kind of precision that drives great outcomes.

Job Summary

In this strategic delivery role, you will be instrumental in modernizing and automating our clients' security operations across the ANZ region. Rather than simply tuning legacy tools, you will deploy and operationalize our AI‑driven Cortex platform, helping customers transition from disjointed security point‑products to a unified, autonomous threat detection and response framework.

Our customers rely on your technical expertise to seamlessly execute these deployments and empower their internal teams through structured knowledge transfer.

While prior experience with our platform is highly valued, a strong foundation in overarching SOC architecture and incident response is even more critical. Having exposure to competing technologies is an advantage, as many of your engagements will involve migrating clients from legacy or alternative solutions over to our Cortex platform.

As part of our comprehensive onboarding program, you will attend our Professional Services Academy to ensure you are fully prepared and experienced with our suite of services before your first customer engagement.

Your Impact

• Drive the deployment, configuration, and operationalization of the Cortex platform for clients across the ANZ region.
• Guide customers through SOC modernization, process re‑engineering, and the transition from legacy SIEM environments to an AI‑driven platform.
• Remotely deploy new Cortex XSIAM tenants, configure on‑premises Broker VMs, and set up advanced automation engines.
• Run collaborative workshops to identify, evaluate, and map customer use cases into actionable correlation rules and analytics.
• Validate and integrate both supported and custom log sources into the platform, ensuring proper data ingestion and parsing.
• Build and re‑engineer automated playbooks to replace manual tier‑1 analyst tasks, drastically reducing mean time to respond (MTTR).
• Optimize alert logic, tune endpoint profiles (malware, exploits), and create exceptions to ensure a low noise‑to‑signal ratio without compromising the security posture.
• Collaborate closely with project managers, taking day‑to‑day direction and ensuring technical delivery aligns with project schedules and scope.
• Deliver comprehensive "as‑built" documentation and conduct structured knowledge transfer sessions to ensure the customer's team is fully prepared to operate the platform.

Qualifications

We are evaluating talent across multiple seniority levels; your scope of responsibility, autonomy, and architectural leadership will be aligned to your demonstrated experience and expertise.

Your Experience

• Deep understanding of modern SOC processes, Incident Response workflows, and the consolidation of SIEM, SOAR, and EDR/XDR solutions.
• Experience crafting custom correlation rules, and identifying Indicators of Compromise (IOCs) and Behavioral Indicators of Compromise (BIOCs).
• Hands‑on experience with data engineering, log ingestion, building custom parsers, and mapping complex data sources to normalized models.
• Proficiency in automation scripting and building custom API integrations (e.g., Python) to streamline incident triage and remediation.
• A consultative approach—you are comfortable leading deep‑dive design discussions and communicating effectively with both engineers and senior stakeholders.
• Previous experience in an MSSP, systems integrator, and consulting environment is highly transferable and welcomed.
• Effectively handle multiple projects and work calmly under pressure in dynamic customer environments.
• Familiarity with ANZ regulatory environments, data sovereignty requirements, and local market dynamics is a plus.
• Australian Citizenship with an active NV1 Security Clearance is a significant advantage for immediate deployment on secure government engagements.

Our Commitment

We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at [e-mail].

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.

Is role eligible for Immigration Sponsorship? No. Please note that we will not sponsor applicants for work visas for this position.