Sydney-based Cortex XSIAM SIEM Expert | Data Pipeline Lead

NCS Australia; Sydney; Hybrid; AUD 140,000 - 200,000; Full time

Job summary

NCS Australia is seeking a SIEM Subject Matter Expert with deep Cortex XSIAM expertise for a Sydney-based role. You will own the enterprise SIEM data pipeline end-to-end—from log onboarding to enrichment, alert tuning, and platform health management.

The ideal candidate will have hands-on Cortex XSIAM experience, data modeling capabilities, automation skills, and proficiency in log parsing languages. This is a contract or permanent opportunity in a collaborative Digital Resilience team.

Qualifications

• Hands-on Cortex XSIAM experience with log ingestion using Broker VMs and XDR Collectors.
• Experience developing SIEM data models, field mapping, enrichment, and schema standardization.
• Automation experience to automate log source onboarding workflows.
• Proficiency in regex, JSON parsing, and structured log analysis.
• Experience in alert tuning and platform health management.
• Based in Sydney with full Australian work rights.

Responsibilities

• Log Source Onboarding: Onboard diverse enterprise log sources, lead parsing, data modeling, and normalization.
• Automation & Tooling: Build and maintain automated onboarding tooling via scripting, APIs, or native capabilities.
• Telemetry Enrichment: Manage enrichment pipelines adding context to raw log events.
• Detection & Alert Tuning: Tune configurations to reduce false positives and improve signal quality.
• Platform Lifecycle Management: Oversee SIEM health, performance, capacity, and upgrades.

Skills

Cortex XSIAM

Data modeling

Automation scripting

Regex / log parsing

Alert tuning

Platform health monitoring

Tools

Broker VMs

XDR Collectors

APIs

Job description

NCS Australia is seeking a SIEM Subject Matter Expert with deep Cortex XSIAM expertise for a Sydney-based role. You will own the enterprise SIEM data pipeline end-to-end—from log onboarding to enrichment, alert tuning, and platform health management.

The ideal candidate will have hands-on Cortex XSIAM experience, data modeling capabilities, automation skills, and proficiency in log parsing languages. This is a contract or permanent opportunity in a collaborative Digital Resilience team.