Senior SIEM & XSIAM/XDR Engineer (Remote, Contract)

CAI; Annapolis (MD); A distancia; USD 96.000 - 110.000; Jornada completa

Descripción de la vacante

CAI is seeking a Senior SIEM Engineer to design, implement, and optimize Palo Alto Cortex XSIAM and Cortex XDR in a large-scale, multi-tenant SOC environment. This remote, contract role requires strong detection engineering and incident response capabilities.

You will configure onboarding, RBAC, data segregation, dashboards, and platform integrations, and develop content, rules, playbooks, and automation to improve security operations.

Formación

• Hands-on experience designing, implementing, and supporting Palo Alto Cortex XSIAM and Cortex XDR.
• Experience supporting SIEM in large-scale, multi-tenant, 24x7 SOC environments.
• Experience developing detection content, rules, analytics, and alert tuning.
• Experience with security automation and incident response playbooks.
• Experience onboarding and troubleshooting cloud, endpoint, network, identity, and telemetry sources.
• Bachelor's degree or equivalent in IT/security and minimum five years of relevant work.

Responsabilidades

• Design, implement, administer, and optimize Cortex XSIAM and Cortex XDR platforms.
• Support SIEM/XDR operations in a multi-tenant 24x7 SOC environment.
• Configure tenant onboarding, RBAC, data segregation, dashboards, reporting, and integrations.
• Develop detection content, rules, analytics, and alert logic.
• Design security automation and incident response workflows.
• Support Cribl log management and data pipeline design.

Conocimientos

Detection engineering

Threat hunting

Incident response

Python

Shell/Bash

Educación

Bachelor's degree in Information Technology/Information Security or related field

Herramientas

Palo Alto Cortex XSIAM

Cortex XDR

Cribl

Descripción del empleo

CAI is seeking a Senior SIEM Engineer to design, implement, and optimize Palo Alto Cortex XSIAM and Cortex XDR in a large-scale, multi-tenant SOC environment. This remote, contract role requires strong detection engineering and incident response capabilities.

You will configure onboarding, RBAC, data segregation, dashboards, and platform integrations, and develop content, rules, playbooks, and automation to improve security operations.