Senior SIEM Engineer: Cortex XSIAM/XDR & Cribl (Remote)

CAI; Frankfort (KY); Remote; USD 96,000 - 110,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401k retirement plan

Paid time off

Job summary

CAI is seeking a Senior SIEM Engineer to design, implement, and optimize Palo Alto Cortex XSIAM/XDR in a large-scale, multi-tenant SOC. This remote, full-time contract role requires strong detection engineering, threat hunting, and automation skills.

You will develop content, configure onboarding, and maintain playbooks while collaborating with security architects and analysts to improve operations across cloud, on-prem, and hybrid telemetry sources.

Qualifications

• Hands-on design, implementation, and support of Cortex XSIAM/XDR in enterprise environments.

Responsibilities

• Design, implement, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR platforms.
• Support SIEM/XDR operations in a large-scale, multi-tenant SOC.
• Configure onboarding, RBAC, data segregation, dashboards, reporting, and integrations.
• Develop and tune detection content, rules, analytics, and alert logic.
• Design and maintain security automation, runbooks, and incident response workflows.
• Support Cribl log management including data modeling and ingestion.
• Integrate platforms with ticketing, identity, and threat intel systems.
• Monitor ingestion performance, alert volumes, and platform health.
• Troubleshoot complex issues and assist SOC analysts during investigations.
• Create runbooks, architecture diagrams, and documentation.
• Participate in monthly on-call rotation for 24x7 SOC.

Skills

Cortex XSIAM

Cortex XDR

Cribl

SIEM operations

Threat hunting

Python

Bash

Education

Bachelor's degree in Information Technology, Information Security, or related field

Tools

Palo Alto Cortex XSIAM

Cortex XDR

Cribl

Python

Bash

Job description

CAI is seeking a Senior SIEM Engineer to design, implement, and optimize Palo Alto Cortex XSIAM/XDR in a large-scale, multi-tenant SOC. This remote, full-time contract role requires strong detection engineering, threat hunting, and automation skills.

You will develop content, configure onboarding, and maintain playbooks while collaborating with security architects and analysts to improve operations across cloud, on-prem, and hybrid telemetry sources.