XSIAM SIEM & Data Management Engineer

AHEAD; United States; On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical, Dental, Vision Insurance

401(k)

Paid time off

Paid parental leave

Job summary

AHEAD is seeking a hands-on SIEM and Data Management Engineer to strengthen our Managed Security program with Cortex XSIAM as the primary platform. You will implement data onboarding, parsing, and enrichment across multiple client environments while collaborating with security teams.

Ideal candidates have strong data engineering skills, experience with SIEM and Elastic Security, and the ability to troubleshoot ingestion issues in a 24/7 SOC setting.

Qualifications

• Experience with Cortex XSIAM data onboarding and storage management.
• Strong parsing, normalization, and data enrichment capabilities for security telemetry.
• Experience with SIEM administration and data ingestion pipelines.

Responsibilities

• Lead and develop XSIAM data onboarding, ingestion, parsing, normalization, enrichment, and storage lifecycle management.
• Onboard client and internal data sources into the SIEM environment using API, syslog, agents, and cloud connectors.
• Develop and tune parsers, field extractions, and normalization logic for usable telemetry.
• Collaborate with analysts and client teams to define log source requirements and reporting.
• Establish data standards for source naming, fields, tagging, and metadata across environments.
• Optimize ingestion pipelines for reliability, scale, and performance across client sources.

Skills

Palo Alto Cortex XSIAM

SIEM

Data onboarding

Log management

Python

Parsers

Regular expressions

Elastic Security

Cloud security

Education

Bachelor’s Degree in Computer Science/Information Security/Engineering

Tools

Palo Alto Cortex XSIAM

Elastic Security

Job description

AHEAD is seeking a hands-on SIEM and Data Management Engineer to strengthen our Managed Security program with Cortex XSIAM as the primary platform. You will implement data onboarding, parsing, and enrichment across multiple client environments while collaborating with security teams.

Ideal candidates have strong data engineering skills, experience with SIEM and Elastic Security, and the ability to troubleshoot ingestion issues in a 24/7 SOC setting.