Remote Cortex XSIAM/XDR Security Architect & SIEM Engineer

VIVA USA Inc; United States; Remote; USD 140,000 - 210,000; Full time

Job summary

VIVA USA Inc. is seeking a Security Architect - Consultant - SIEM Engineer to design, implement and optimize Cortex XSIAM and Cortex XDR in a 24x7, multi-tenant SOC environment.

The contractor will lead detection engineering, automation and playbook development while supporting Cribl data pipelines and log ingestion across cloud and on‑premise sources. The role emphasizes hands‑on engineering, incident response and threat hunting, with on‑call rotation and remote work nationwide.

Qualifications

• Hands‑on Cortex XSIAM/XDR design, implementation and admin.
• Experience supporting multi‑tenant SOC operations and 24x7 SOC.
• Experience developing/detecting rules, analytics and threat hunting queries.
• Ability to create and manage complex playbooks.

Responsibilities

• Plan, design, deploy and support enterprise SIEM and XDR capabilities.
• Assist with log pipeline design, routing, parsing, normalization and ingestion.
• Develop automated response workflows and runbooks for incident handling.
• Support SOC analysts through platform troubleshooting and knowledge transfer.
• Monitor ingestion health, platform availability and alert quality.
• Ensure high availability, backup and change control for SIEM/XDR services.
• Collaborate with stakeholders to align solutions with security requirements.

Skills

Cortex XSIAM

Cortex XDR

Threat hunting

Playbooks

Python scripting

Bash scripting

Multi-tenant SOC

Incident response

Log pipelines

SIEM engineering

Education

Bachelor's degree in IT or Information Security

Eight years of relevant work experience may be substituted

Five years of experience in large IT environments

Tools

Palo Alto Cortex XSIAM

Palo Alto Cortex XDR

Cribl

Python

Bash

Job description

VIVA USA Inc. is seeking a Security Architect - Consultant - SIEM Engineer to design, implement and optimize Cortex XSIAM and Cortex XDR in a 24x7, multi-tenant SOC environment.

The contractor will lead detection engineering, automation and playbook development while supporting Cribl data pipelines and log ingestion across cloud and on‑premise sources. The role emphasizes hands‑on engineering, incident response and threat hunting, with on‑call rotation and remote work nationwide.