XSIAM SIEM Data Engineer

AHEAD; Chicago (IL); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical, Dental, Vision Insurance

401(k)

Job summary

AHEAD is hiring a SIEM and Data Management Engineer to join its Managed Security team in Chicago. You will own data onboarding, parsing, normalization, and storage for Cortex XSIAM, collaborating with security analysts and client teams to deliver reliable security telemetry and insights.

The role emphasizes hands-on SIEM engineering, data pipeline optimization, and cross-team collaboration to improve onboarding validation and dashboard readiness for diverse client environments.

Qualifications

• Experience with Palo Alto Cortex XSIAM, focusing on data onboarding, ingestion pipelines, parsing, and storage management
• XSIAM or SIEM administration and configuration experience with emphasis on data onboarding, ingestion pipelines, parsing, normalization, and storage management
• Knowledge of log collection and transport techniques (API, syslog, agents, file-based collection, cloud connectors)
• Experience developing or tuning parsers, field mappings, regular expressions, and normalization for security telemetry
• Understanding data lifecycle concepts (index lifecycle management, retention, tiered storage) and storage optimization
• Experience writing automation scripts in Python or similar languages
• Strong verbal and written communication, ability to work independently and with a team
• 2–4 years in Information Security, SIEM engineering, or security operations
• Hands-on experience with security technologies (firewalls, IDS, EDR, SIEM, SOAR, IAM, cloud security tools) and telemetry
• Familiarity with security data standards and analytics workflows

Responsibilities

• Lead configuration and development for XSIAM data onboarding, ingestion, parsing, normalization, and storage lifecycle management
• Onboard client and internal data sources into Managed Security SIEM using diverse collection methods
• Develop and tune parsers, field extractions, transformations, and normalization logic
• Collaborate with analysts, detection engineers, and client teams to define log source requirements
• Establish data standards for naming, tagging, and normalization across environments
• Support and optimize ingestion pipelines for reliability, scale, and performance
• Troubleshoot data collection, transport, parsing, and indexing issues
• Manage data tiering, storage allocation, and retention per contractual requirements
• Analyze data quality and health across sources; improve pipeline efficiency

Skills

XSIAM

SIEM

log management

security data engineering

Python

data onboarding

parsers

regular expressions

communication

team collaboration

Education

Bachelor's Degree in Computer Science, Information Security, Engineering, or related/equivalent educational or work experience

Tools

Palo Alto Cortex XSIAM

Elastic Security

Job description

AHEAD is hiring a SIEM and Data Management Engineer to join its Managed Security team in Chicago. You will own data onboarding, parsing, normalization, and storage for Cortex XSIAM, collaborating with security analysts and client teams to deliver reliable security telemetry and insights.

The role emphasizes hands-on SIEM engineering, data pipeline optimization, and cross-team collaboration to improve onboarding validation and dashboard readiness for diverse client environments.