Security architect-Consultant-SIEM Engineer

Job Title: SIEM Engineer (Cortex XSIAM / XDR), Security Architect Consultant. 100% Remote

Employment Type: Contract, [W2 / 1099]
Location: Remote (US)
Duration: [12 months, possible extension]
Work Authorization: / no sponsorship

About the Role

We’re hiring an experienced SIEM Engineer for a new role with a state government client’s Department of Administration, Division of Information Security (DIS). You’ll join a large enterprise security team and a 24x7 Security Operations Center that protects multiple state agencies. You’ll work with full-time security architects, engineers, and analysts to design, build, and improve SIEM, XDR, and detection-and-response capabilities.

The role centers on Palo Alto Cortex XSIAM and Cortex XDR: engineering, administration, detection content, automation, and operational support. You’ll also provide secondary support for Cribl data modeling and log pipelines. It’s a hands-on job that spans security engineering and SOC operations in a large, multi-tenant environment.

What You’ll Do

Primary: Cortex XSIAM / XDR engineering

• Plan, design, deploy, configure, optimize, and troubleshoot Cortex XSIAM and Cortex XDR.
• Onboard agencies in a multi-tenant environment, including tenant-specific configuration, role-based access, data segregation, dashboards, and reporting.
• Build and tune detections, correlation rules, analytics, threat-hunting queries, watchlists, and suppression logic to reduce false positives.

Secondary: Log management and data pipelines

• Design Cribl data models and pipelines, covering routing, parsing, normalization, enrichment, filtering, replay, and ingestion.
• Onboard and monitor telemetry from cloud, endpoint, network, identity, SaaS, and custom application sources.
• Optimize log volume, retention, performance, and cost while meeting security and compliance requirements.
• Integrate with ticketing, case management, notification, identity, and threat intelligence systems.

Automation, operations, and enablement

• Develop, test, and maintain automated response playbooks for enrichment, triage, containment, escalation, notifications, and case management.
• Write and maintain runbooks, SOPs, escalation matrices, troubleshooting guides, architecture and data-flow diagrams, use-case catalogs, and knowledge articles.
• Support Tier 1–3 SOC analysts and incident responders with escalations, detection tuning, threat hunting, knowledge transfer, and shift handoffs.
• Report on ingestion health, platform availability, alert volumes, detection coverage, false positives, SLAs, MTTD/MTTR, and tenant-level metrics.
• Keep SIEM, XDR, and pipeline services highly available and resilient, with backup, recovery, lifecycle management, and controlled change.
• Work with architects, engineers, and agency stakeholders to align solutions with business goals, industry frameworks, regulatory requirements, and risk tolerance.

Required Skills (in order of importance)

• Hands-on design, implementation, administration, and operational support of Palo Alto Cortex XSIAM and Cortex XDR.
• Experience engineering SIEM capabilities for multi-tenant environments and 24x7 SOC operations.
• Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
• Automation, integrations, and playbook development using Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Strong grasp of enterprise security architecture, incident response, networking, access control, secure system design, and cybersecurity frameworks.

Additional Skills

• Developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reports, and alert suppression.
• Building and managing complex playbooks.
• Familiarity with security and compliance frameworks, and experience writing runbooks, procedures, and technical documentation.
• Supporting Tier 1–3 SOC analysts, threat hunting, incident response, and 24x7 handoffs.

Education and Experience

• Bachelor’s degree in IT, Information Security, or a related field. Eight years of relevant experience may substitute for the degree.
• At least 5 years supporting large IT environments and/or system deployments.

Preferred Certifications

• CISSP, Security+, or a GIAC certification.
• Palo Alto Cortex, Cribl, or another relevant SIEM/security platform certification.

Schedule

• 100% remote.
• Monthly on-call rotation supporting the 24x7 SOC.
• After-hours maintenance, incident escalation support, and operational handoffs as needed.

Mandatory Screening (no exceptions)
Candidates must pass all of the following before starting:

• 7-year background check and credit history check
• Driving record (MVR)
• 10-panel drug screen
• E-Verify
• SLED check

After onboarding, you must obtain and keep an annual CJIS certification.