Cortex XSIAM SIEM Data Engineer

Socket.dev; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical, Dental, and Vision Insurance

401(k)

Paid holidays

Paid time off

Parental leave

Job summary

AHEAD is seeking a hands-on SIEM and data management engineer to enhance data onboarding, parsing, and storage for our managed security platforms. You will work with the Managed Security team to streamline ingestion pipelines and ensure telemetry is reliable across client environments.

This role requires deep experience with Cortex XSIAM, SIEM operations, and data engineering, plus the ability to collaborate with analysts and client technical teams on onboarding and validation tasks.

Qualifications

• 2–4 years of experience in Information Security, SIEM engineering, data engineering for security operations, or related disciplines.
• Strong knowledge of regular expressions, log formats, and data transformation concepts.
• Experience writing Python to automate onboarding checks and data quality assessments.

Responsibilities

• Lead and perform configuration and development activities related to XSIAM data onboarding, ingestion, and storage lifecycle.
• Onboard new client and internal data sources into the Managed Security SIEM environment using multiple collection methods.
• Develop, tune, and normalize parsers and field extractions to ensure usable telemetry across environments.
• Collaborate with security analysts and client teams to define log source requirements and investigations.
• Establish data standards for source naming, tagging, and normalization across client environments.
• Support and optimize ingestion pipelines for reliability, scale, and performance.

Education

Bachelor's Degree in Computer Science, Information Security, Engineering, or related/equivalent

Tools

Elastic Security

Cortex XSIAM

Job description

AHEAD is seeking a hands-on SIEM and data management engineer to enhance data onboarding, parsing, and storage for our managed security platforms. You will work with the Managed Security team to streamline ingestion pipelines and ensure telemetry is reliable across client environments.

This role requires deep experience with Cortex XSIAM, SIEM operations, and data engineering, plus the ability to collaborate with analysts and client technical teams on onboarding and validation tasks.