SIEM Engineer (Palo Alto Cortex XSIAM/XDR)

Cornerstonetechtalent; Columbia (SC); Remote; USD 120,000 - 160,000; Full time

Job summary

CornerStone TTS seeks a SIEM Engineer with hands-on Palo Alto Cortex XSIAM and Cortex XDR experience to support a 24x7 SOC for a South Carolina state agency client. This 12-month remote contract offers full-time engagement and a chance to architect and operate a multi-tenant SIEM/XDR platform.

You will onboard tenants, manage access controls, detections and correlations, conduct threat hunting, and craft dashboards and automation playbooks in Python/Bash, leveraging Cribl log pipelines to

Qualifications

• Bachelor's degree in IT or Information Security, or 8+ years of relevant work substituting education.
• Extensive experience with Palo Alto Cortex XSIAM/XDR design, implementation and operations.
• Proven track record in multi-tenant SIEM environments and SOC operations.
• Strong scripting in Python and Bash for automation and playbooks.

Responsibilities

• Engineer and support a 24x7 multi-tenant SIEM/XDR platform.
• Onboard tenants, manage access controls, detections and correlation rules.
• Develop threat hunting workflows, dashboards and automation playbooks.
• Build and maintain Cribl log pipelines for ingestion and enrichment.

Skills

Palo Alto Cortex XSIAM

Palo Alto Cortex XDR

SIEM

Cribl

Python

Bash

Automation

Threat hunting

Log pipelines

Telemetry onboarding

Education

Bachelor's degree in IT or Information Security

Tools

Cribl

Job description

SIEM Engineer (Palo Alto Cortex XSIAM/XDR) - 12-Month Remote Contract

CornerStone TTS is looking for a SIEM Engineer with hands-on Palo Alto Cortex XSIAM and Cortex XDR experience for a South Carolina state agency client.

This is a 100% remote, full-time (40 hrs/week) 12-month contract. You will engineer and support a multi-tenant SIEM/XDR platform for a 24x7 Security Operations Center: tenant onboarding, access controls, detections and correlation rules, threat hunting, dashboards, automation playbooks in Python/Bash, and Cribl log pipelines.

Required qualifications:

• Bachelor's Degree in an Information Technology or Information Security related field; 8+ years of relevant work may be substituted in lieu of education
• 5+ years of experience in supporting large IT environments and/or system deployments
• Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, and operational support
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations
• CRIBL data modeling, log pipeline design, parsing, normalization, enrichment, routing and ingestion experience
• Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources
• Enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks

Preferred qualifications:

• CISSP, Security+ or GIAC certification
• Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification

Location and schedule:

• Remote in the United States.
• Schedule: Day, 40 hours per week.
• None stated
• 100% remote within the US; no state residency rule.

Duration and start:

• 12-month contract; projected start Mon Nov 30, 2026.

Pre-start screening:

• Full credit check and criminal background check at hire.
• Annual CJIS certification once onboard.
• 7-year background and credit history check.
• Driving record (MVR).
• 10-panel drug screen.
• E-Verify.
• SLED check.