Firefighter: Emergency Response & Rescue

Kouga Local Municipality; South Africa; On-site; ZAR 900,000 - 2,000,000; Full time

Job summary

NTT DATA in South Africa is seeking a Principal Security Platforms Engineer to lead the MSSP Cortex XSIAM platform architecture, onboarding, and automation. You will mentor SOC engineers and collaborate with security, engineering, and customer success teams to drive platform excellence.

The role requires deep knowledge of XSIAM, SIEM, SOAR, and cloud security across Azure, AWS, and GCP, with strong scripting and API skills in Python, PowerShell, REST, and KQL.

Qualifications

• Deep expertise in Cortex XSIAM, SIEM, SOAR and XDR.
• Strong experience with security telemetry normalization and detection logic.
• Proficiency in Python, PowerShell, REST APIs, KQL and XQL.
• Cloud security exposure across Azure, AWS and GCP.

Responsibilities

• Own architecture, roadmap and evolution of the MSSP Cortex XSIAM and related platforms.
• Design multi-tenant service architecture for managed security services.
• Lead architecture reviews and drive scalability, performance and cost optimizations.
• Mentor SOC engineers and coordinate with engineering and customer success teams.
• Develop and maintain platform standards, procedures and integration guides.
• Provide L4 escalation support for complex platform issues and incidents.

Skills

Cortex XSIAM architecture

SIEM

SOAR

XDR

Detection engineering

Automation engineering

Python

PowerShell

REST APIs

KQL

XQL

Cloud security

Azure

AWS

GCP

Leadership

Mentoring

Job description

**Make an impact with NTT DATA**
Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations, and for making a difference to our clients and society. Our workplace embraces diversity and inclusion - it's a place where you can grow, belong and thrive.
**Your day at NTT DATA**
**Role Summary**
The Principal Security Platforms Engineer serves as a subject matter expert for the MSSP's Palo Alto Cortex XSIAM platform but is not limited to and associated security operations technologies. The role is responsible for the strategic evolution, architecture, engineering, automation, onboarding, Agentic AI and operational excellence of the security platforms ecosystem incl. XSIAM.
The successful candidate will provide technical leadership across platform architecture, log onboarding and normalization, detection engineering, automation, content development, integrations, and advanced troubleshooting while acting as a technical mentor and escalation point for engineering and SOC teams.
This role combines Security Architecture, Security Engineering, Detection Engineering and Automation Engineering responsibilities to ensure the security platform continuously evolves to support managed security services, threat detection, incident response and customer onboarding requirements.
**Key Responsibilities**
**XSIAM and Other Security Platforms:**

• Support the overall architecture, roadmap, and strategic evolution of the MSSP Cortex XSIAM platform and other security platforms.
• Design and maintain multi-tenant service architecture supporting managed security services customers alongside capability teams.
• Lead platform architecture reviews and recommend improvements to scalability, performance, resilience and cost optimization.
• Act as trusted advisor for onboarding, architecture, use-case development and platform optimization initiatives.
• Lead and build new service platform and automation for the SOC/security services
• Support platform upgrades, new integrations design, build and enhance, and feature adoption within XSIAM and other associated security platforms
• Act as L4 escalation support for complex platform issues such platform disruptions, ingestion failures, automation failures and detection gaps.
• Act as an advisor for the development and optimization of:
• Correlation and Suppression Rules
• Alert tuning strategies and Threat intelligence integrations
• Support to develop and maintain XQL-based use cases and detection logic.
• Support in improving the detection coverage by aligning content against MITRE ATT&CK techniques.
• Support in continuous reduction of false positives and alert fatigue.
• Review detection performance and recommend improvements based on threat trends and SOC feedback.
• Engage directly with vendor TAC and engineering teams on critical incidents.
• Provide technical leadership and guidance to SOC, Engineering, and Customer Success teams.
• Review customer requirements and recommend security monitoring strategies.
• Develop and maintain:
• Platform standards
• Engineering procedures
• Integration guides
• Document and share operational and engineering knowledge across teams. Mentor Platform, Detection, and SOC Engineers and Analysts.
• Drive technical best practices across the MSSP security engineering function.

**Knowledge and Attributes**

• Strong knowledge of Cortex XSIAM architecture and operations, SIEM, SOAR, XDR, detection engineering, and modern SOC practices.
• Working knowledge of Python, PowerShell, Rest APIs, KQL, and XQL.
• Deep expertise in security telemetry normalization, correlation, MITRE ATT&CK, threat detection, automation, and orchestration.
• Strong cloud security experience across Azure, AWS, and GCP. Excellent analytical, troubleshooting, consulting, stakeholder engagement, communication, mentoring, and technical leadership skills, with the ability to independently drive