Remote Cortex XSIAM & SIEM Engineer – 24x7 SOC

RICEFW Technologies Inc; Columbia (SC); Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Remote work

On-call rotation

Job summary

RICEFW Technologies Inc. is seeking a remote SIEM/XDR engineer to join a 24x7 SOC supporting multiple state agencies. The role is 100% remote with a monthly on-call rotation; after-hours maintenance may be required as needed.

You will deploy and optimize Palo Alto Cortex XSIAM/XDR, Cribl data pipelines, and enable multi-tenant onboarding, detection, and automation. The position supports Tier 1–3 analysts across cloud, endpoint, network, identity, and SaaS telemetry.

Qualifications

• Experience engineering and supporting SIEM capabilities for 24x7 SOC operations.
• Experience with Cribl data pipelines and Cortex XSIAM/XDR.
• Automation and orchestration using Python and Bash.
• Onboarding telemetry from cloud, endpoint, network, identity, SaaS and custom apps.
• Familiarity with security frameworks and incident response processes.

Responsibilities

• Plan, design, deploy and support SIEM/XDR architectures for a 24x7 SOC environment.
• Develop, test and maintain automated playbooks and runbooks for incident response.
• Monitor ingestion health, platform availability and alerting metrics.
• Support Tier 1–3 SOC analysts with troubleshooting and escalation.
• Collaborate with security architects, engineers and stakeholders to align solutions with business goals.

Skills

SIEM engineering

XSIAM/XDR

Cribl data pipelines

Python scripting

Telemetry onboarding

Multi-tenant SOC support

Education

Information Technology or Information Security field

Tools

Palo Alto Cortex

Cribl

Job description

RICEFW Technologies Inc. is seeking a remote SIEM/XDR engineer to join a 24x7 SOC supporting multiple state agencies. The role is 100% remote with a monthly on-call rotation; after-hours maintenance may be required as needed.

You will deploy and optimize Palo Alto Cortex XSIAM/XDR, Cribl data pipelines, and enable multi-tenant onboarding, detection, and automation. The position supports Tier 1–3 analysts across cloud, endpoint, network, identity, and SaaS telemetry.