Remote Senior MSIAM & SIEM Detection Engineer

Palo Alto Networks; Charlotte (NC); Remote; USD 135,000 - 218,000; Full time

Job summary

Palo Alto Networks is seeking a Senior Detection Engineer to advance correlation rules and detection logic across Cortex XSIAM. This remote role supports Enterprise customers with expertise in threat intelligence translation, automation, and proactive defense engineering.

You will lead the Detection Engineering lifecycle, implement robust playbooks, and collaborate on architecture decisions to strengthen incident response and threat-hunting capabilities.

Qualifications

• 5+ years in a Senior SOC/Detection Engineering or Security Architecture role using SIEMs, firewalls, EDR.
• Proven lifecycle experience for Detection Engineering, including rule testing and tuning.
• Experience QA-ing detection logic and providing optimization feedback.
• Proactive automation with complex playbooks in Cortex XSOAR or similar.
• Strong incident response, threat hunting, and translating threat intel into defenses.
• Software development experience with Python for security automation.
• Excellent consultative and communication skills guiding enterprise customers.

Responsibilities

• Drive the continuous refinement of correlation rules, ensuring all deployed detection logic meets standards for performance, accuracy, and relevance.
• Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable detection logic.
• Champion proactive automation, engineering sophisticated playbooks to resolve emerging security challenges.
• Architect the end-to-end security lifecycle within Cortex XSIAM, connecting data ingestion, detection engineering, and response automation.

Skills

Detection Engineering

Incident response

Threat hunting

Python for security automation

Automation playbooks

Consulting skills

Tools

Cortex XSOAR

Cortex XSIAM

SIEM

EDR

SOAR

Job description

Palo Alto Networks is seeking a Senior Detection Engineer to advance correlation rules and detection logic across Cortex XSIAM. This remote role supports Enterprise customers with expertise in threat intelligence translation, automation, and proactive defense engineering.

You will lead the Detection Engineering lifecycle, implement robust playbooks, and collaborate on architecture decisions to strengthen incident response and threat-hunting capabilities.