XSIAM Engineer

Lumen Technologies India; Dadri; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Lumen Technologies India is seeking an XSIAM Engineer to administer and improve Cortex XSIAM environments, supporting onboarding, alert tuning, dashboards, and platform readiness for AMDR monitoring. You will work with SOC, SIEM, EDR, automation, and IT teams to ensure stability and scalability.

The role covers data ingestion, parsing rules, data models, validation, and documenting engineering notes, with coordination during onboarding and steady-state support.

Qualifications

• Hands-on SIEM/XDR platforms experience.
• Familiarity with Cortex XSIAM, Cortex XDR, Splunk, Sentinel, QRadar.
• Understanding of log formats JSON/CEF/Syslog and API ingestion.
• Basic scripting/queries (Python/PowerShell/Bash/SQL-like).
• Experience with alert triage, detection logic, and incident workflows.
• Strong troubleshooting, documentation, and cross-team communication skills.

Responsibilities

• Onboard data sources into Cortex XSIAM (Syslog, API sources, endpoint telemetry, cloud logs).
• Configure/maintain parsing rules, field mappings, data models, and ingestion validation.
• Support detection tuning, alert logic refinement, and rule lifecycle management.
• Assist with dashboards, reports, alert views, and operational metrics.
• Validate data quality, retention, telemetry coverage, and ingestion health.
• Troubleshoot ingestion, parsing, connectors, and integration issues.
• Support XSIAM use case development with SOC analysts and threat hunters.
• Maintain platform documentation, onboarding guides, data dictionaries, and engineering notes.
• Collaborate with SOC, IT, customer teams, and platform owners during onboarding and steady-state support.
• Participate in customer technical discussions and deployment readiness reviews.

Skills

SIEM/XDR

Cortex XSIAM

Security analytics

Scripting

Incident investigation

Cross-team collaboration

Tools

Cortex XSIAM

Cortex XDR

Splunk

QRadar

Job description

Summary

The XSIAM Engineer is responsible for administering, maintaining, and improving Palo Alto Cortex XSIAM environments. This role supports platform operations, log and data onboarding, detection enablement, alert tuning, dashboard/report creation, and customer environment readiness. The engineer works closely with SOC, SIEM, EDR, automation, and IT teams to ensure XSIAM is stable, scalable, and operationally useful for AMDR monitoring.

Key Responsibilities

• Onboard new data sources into Cortex XSIAM, including Syslog, API-based sources, endpoint telemetry, cloud logs, and third-party security tools.
• Configure and maintain parsing rules, field mappings, data models, and ingestion validation.
• Support detection tuning, alert logic refinement, and rule lifecycle management.
• Assist with dashboards, reports, alert views, and operational metrics.
• Validate data quality, retention, telemetry coverage, and ingestion health.
• Troubleshoot ingestion, parsing, connector, and integration issues.
• Support XSIAM use case development in partnership with SOC analysts and threat hunters.
• Maintain platform documentation, onboarding guides, data dictionaries, and engineering notes.
• Collaborate with SOC, IT, customer teams, and platform owners during onboarding and steady-state support.
• Participate in customer technical discussions, deployment readiness reviews, and operational handoffs as needed.

Required Qualifications

• 6-10 years of hands-on experience with SIEM, XDR, SOAR, or security analytics platforms.
• Familiarity with Cortex XSIAM, Cortex XDR, Splunk, Sentinel, QRadar, or similar platforms.
• Understanding of log formats such as JSON, CEF, Syslog, and API-based data ingestion.
• Basic scripting or query experience using Python, PowerShell, Bash, XQL, SQL-like query languages, or similar.
• Familiarity with security operations, alert triage, detection logic, and incident investigation workflows.
• Strong troubleshooting, documentation, and cross-team communication skills.

Preferred Certifications

• Palo Alto Cortex XSIAM or Cortex XDR certification
• Palo Alto PCCET or PCNSA
• CompTIA Security+ (secondary)
• GIAC GCIH, GCIA, or equivalent security operations certification
• We are an equal opportunity employer committed to fair and ethical hiring practices. We do not charge any fees or accept any payment from candidates at any stage of the recruitment process.

SIEM, Infosec