Senior Cortex XSIAM SIEM Engineer

Programmers.io; United States; Presencial; USD 120.000 - 170.000; Jornada completa

Descripción de la vacante

Programmers.io seeks an experienced Cortex XSIAM expert to architect, deploy, and operate enterprise SIEM/SOAR solutions. You will own data onboarding, broker VM configurations, XQL-based detections, and multi-source normalization to deliver reliable visibility.

The role involves collaborating with customers and internal security teams to design detection content aligned with MITRE ATT&CK, tune alerts, and build actionable dashboards.

Formación

• 6+ years hands-on experience deploying and managing SIEM and SOAR solutions.
• Direct experience with Palo Alto Networks Cortex XSIAM.
• Onboarding log sources and integrating them into Cortex XSIAM.
• Developing and managing XSIAM Data Models and normalization across data sources.
• Crafting and optimizing detection logic using XQL for correlation rules and dashboards.
• Experience with endpoint integration and policy tuning for better visibility.
• Familiarity with MITRE ATT&CK and best practices for threat detection.

Responsabilidades

• Collaborate with technical leads to define a robust log ingestion strategy for Cortex XSIAM using Broker VMs and Collectors.
• Serve as Security Analyst and SIEM Engineer, owning end-to-end workflows from onboarding to detection content development and incident support.
• Design and implement XQL-based correlation rules to detect and alert across endpoint, network, and cloud environments.
• Create, tune, and manage data models to normalize and enrich telemetry data.
• Build operational dashboards using XQL to provide insights into threat posture and coverage.
• Act as SME for XSIAM log ingestion, correlation logic, alert tuning, and detection strategy development.
• Engage with customers to assess environments and recommend log onboarding and threat coverage.
• Monitor, optimize, and troubleshoot log source ingestion pipelines and Collector/Broker VM performance.
• Fine-tune alerts to minimize false positives and improve SOC efficiency.
• Collaborate with threat intel and detection engineering to map detections to ATT&CK techniques.
• Support analysts in investigations and leveraging XSIAM automation features.
• Drive automation opportunities using XSIAM playbooks to reduce manual workload.
• Conduct workshops and health checks to promote adoption and maturity of XSIAM usage.
• Participate in post-incident reviews and gap analyses to strengthen threat detection.

Conocimientos

Cortex XSIAM

XQL

Log onboarding

Data models

Dashboards

Regex

JSON parsing

Threat hunting

MITRE ATT&CK

XDR integration

Endpoint integration

Educación

Bachelor's degree in Computer Science, Information Security, or related field

Palo Alto Networks Certified XSIAM Engineer / XSIAM Analyst / EDU-270

Herramientas

Broker VMs

Collectors

Descripción del empleo

Programmers.io seeks an experienced Cortex XSIAM expert to architect, deploy, and operate enterprise SIEM/SOAR solutions. You will own data onboarding, broker VM configurations, XQL-based detections, and multi-source normalization to deliver reliable visibility.

The role involves collaborating with customers and internal security teams to design detection content aligned with MITRE ATT&CK, tune alerts, and build actionable dashboards.