Senior SIEM​/XDR Security Engineer

Position: Senior SIEM/XDR Security Engineer # 26-27985

Duration: 12 Months

Daily duties / responsibilities:

• Primarily assist in the planning, design, deployment, administration and operational support of enterprise SIEM and XDR capabilities, including:
• Palo alto cortex XSIAM and cortex XDR platform engineering, configuration, optimization and troubleshooting
• Multi-tenant agency onboarding, tenant-specific configuration, role-based access, data segregation, dashboards and reporting
• Detection engineering, correlation rules, analytics, threat-hunting queries, watchlists, suppression logic and false-positive reduction
• Secondarily assist in the planning, design, deployment and operational support of log management and security data pipelines, including:
• Cribl data modeling, log pipeline design, routing, parsing, normalization, enrichment, filtering, replay and ingestion
• Onboarding and health monitoring of cloud, endpoint, network, identity, SAAS and custom application telemetry
• Log volume, retention, performance and cost optimization while maintaining security and compliance requirements
• Integrations with ticketing, case management, notification, identity, threat intelligence and other enterprise systems as needed
• Develop, test, deploy and maintain automated response workflows and playbooks for enrichment, triage, containment, escalation, notifications, case management and incident response.
• Create and maintain operational runbooks, standard operating procedures, escalation matrices, troubleshooting guides, architecture diagrams, data-flow documentation, use-case catalogs and analyst knowledge articles.
• Support tier 1 through tier 3 soc analysts and incident responders through platform troubleshooting, detection tuning, threat hunting, technical escalation, knowledge transfer and shift handoffs.
• Monitor and report on ingestion health, platform availability, alert volumes, detection coverage, false positives, service levels, mean time to detect, mean time to respond and tenant-specific operational metrics.
• Ensure high availability, resilience, backup, recovery, lifecycle management and controlled change processes for SIEM, XDR and supporting log pipeline services.
• Collaborate with security architects, engineers, analysts and agency stakeholders to align solutions with business goals, industry-standard frameworks, regulatory requirements and organizational risk tolerance.

Required skills (rank in order of importance):

• Hands-on palo alto cortex XSIAM and cortex XDR design, implementation, administration and operational support.
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations.
• Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing and ingestion.
• Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks.

Required education/certifications:

• Bachelor's degree in an information technology or information security related field
• Eight years of relevant work experience may be substituted in lieu of education
• Five years of experience in supporting large it environments and/or system deployments

Preferred education/certifications:

• CISSP, Security+ or GIAC certification
• Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification

Additional skills & duties:

• Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting and alert suppression logic.
• Strong experience creating and managing complex playbooks
• Familiarity with industry-standard security and compliance frameworks and experience developing playbooks, runbooks, procedures and technical documentation.
• Experience supporting Tier 1 through Tier 3 SOC analysts, threat hunting, incident response and 24x7 operational handoffs.

Location:

Remote (Columbia, SC)

Candidate

Location:

This position is 100% remote and will participate in a monthly on-call rotation supporting a 24x7 security operation. Other after-hours work may be required as needed

About US Tech Solutions:

US Tech Solutions is a global staff augmentation firm providing a wide range of talent on-demand and total workforce solutions. To know more…