Remote Senior SIEM Engineer — Cortex XSIAM/XDR Expert

Sunshine Enterprise USA LLC; Columbia (SC); On-site; USD 140,000 - 170,000; Part time

Job summary

Sunshine Enterprise USA LLC is seeking an experienced SIEM Engineer to design, implement, and operate Palo Alto Cortex XSIAM/XDR in a remote, contract role. The candidate will support multi-tenant environments and a 24x7 SOC, with focus on detection engineering, automation, and telemetry onboarding.

The role requires strong Cribl experience, Python/Bash playbooks, and collaboration with security architects and business stakeholders across the enterprise.

Qualifications

• Hands-on with Palo Alto Cortex XSIAM and Cortex XDR architecture, implementation, administration, and operational support.
• Experience supporting enterprise SIEM platforms within large multi-tenant environments.
• Experience supporting 24x7 Security Operations Centers (SOC).
• Threat hunting.
• Analytics.
• False‑positive reduction.
• Hands‑on Cribl administration including: Data modeling, Parsing, Routing, Ingestion, Python, Bash.
• Experience onboarding cloud, endpoint, network, identity, SaaS, Windows, Linux, and custom application telemetry.
• Strong knowledge of: Enterprise security architecture, Networking, Identity & Access Management, Cybersecurity frameworks.

Responsibilities

• Design, implement, configure, and maintain Palo Alto Cortex XSIAM and Cortex XDR platforms.
• Support multi-tenant SIEM environments, including tenant onboarding, role-based access, data segregation, dashboards, and reporting.
• Develop and optimize: Detection rules, Correlation rules, Analytics, Threat hunting queries, Watchlists, Alert suppression logic.
• Design and manage Cribl log pipelines, including: Data modeling, Parsing, Normalization, Enrichment, Routing, Filtering, Replay, Log ingestion.
• Integrate telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom applications.
• Develop and maintain automated playbooks and response workflows using Python and Bash.
• Support incident response, threat hunting, and SOC operations.
• Create and maintain: Runbooks, SOPs, Architecture diagrams, Data flow documentation, Knowledge articles.
• Support Tier 1–Tier 3 SOC analysts through troubleshooting, tuning, and knowledge transfer.
• Monitor SIEM health, ingestion, availability, detection coverage, false positives, MTTD, MTTR, and operational metrics.
• Ensure platform resilience, backup, recovery, lifecycle management, and change control.
• Collaborate with security architects, engineers, analysts, and business stakeholders to improve enterprise security capabilities.

Skills

Palo Alto Cortex XSIAM

Cortex XDR

SIEM architecture

Threat hunting

Cribl administration

Python

Bash

SOC operations

Data telemetry onboarding

Security analytics

Education

Bachelor's degree in Information Technology/Information Security/Computer Science

Tools

Cribl

Python

Bash

Job description

Sunshine Enterprise USA LLC is seeking an experienced SIEM Engineer to design, implement, and operate Palo Alto Cortex XSIAM/XDR in a remote, contract role. The candidate will support multi-tenant environments and a 24x7 SOC, with focus on detection engineering, automation, and telemetry onboarding.

The role requires strong Cribl experience, Python/Bash playbooks, and collaboration with security architects and business stakeholders across the enterprise.