[Hiring] Senior Cybersecurity SIEM Engineer/Security Architect @Information Resource group

Role Description

The candidate will work as a SIEM Engineer for the Department of Administration's Division of Information Security. The main responsibility is to design, implement, manage, and improve Palo Alto Cortex XSIAM and Cortex XDR security platforms.

• Work with a large enterprise security team and a 24/7 SOC team.
• Help security architects, engineers, and analysts build, maintain, and improve security monitoring, threat detection, and incident response systems.
• Support multiple state agencies.

Qualifications

• Bachelor's Degree in an Information Technology or Information Security related field; 8+ years of relevant work may be substituted in lieu of education.
• 5+ years of experience in supporting large IT environments and/or system deployments.
• Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, and operational support.
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations.
• CRIBL data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion experience.
• Experience developing automation, integrations, playbooks, and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks.

Requirements

• Must successfully pass a full credit check.
• Must successfully pass a criminal background check during the initial hiring process.
• Must obtain and maintain annual CJIS certification after joining.

Benefits

• Fully remote position.
• 12 months contract with the possibility of extensions.
• Participate in a monthly on-call rotation to support the 24/7 Security Operations Center (SOC).
• Occasional after-hours maintenance, incident support, and shift handoffs may be required.

Daily Duties and Responsibilities

• Palo Alto Cortex XSIAM and XDR – Primary Responsibility
  • Design, configure, implement, manage, and troubleshoot Palo Alto Cortex XSIAM and Cortex XDR.
  • Set up different state agencies on the platform with separate access, configurations, dashboards, and reports.
  • Create and improve security detection rules to identify suspicious activities and threats.
  • Perform threat hunting and reduce false security alerts.
• Cribl and Log Management – Secondary Responsibility
  • Support Cribl for collecting, processing, managing, and routing security logs.
  • Configure log parsing, filtering, normalization, and data enrichment.
  • Connect and monitor logs from cloud systems, computers, networks, identity systems, SaaS applications, and other sources.
  • Manage log storage, volume, performance, and costs while maintaining security requirements.
• Security Integrations and Automation
  • Integrate security platforms with ticketing systems, case management tools, identity systems, and threat intelligence tools.
  • Develop and maintain automated security response workflows.
  • Automate activities such as threat investigation, incident escalation, notifications, and security response.
• Documentation and Procedures
  • Create and maintain technical documentation, including:
    • Operational procedures and runbooks.
    • Troubleshooting guides.
    • Security escalation procedures.
    • System architecture diagrams.
    • Data flow documentation.
    • Security use cases and knowledge articles.
• SOC Team Support
  • Provide technical support to Tier 1, Tier 2, and Tier 3 SOC analysts.
  • Help analysts troubleshoot security platform issues.
  • Support threat hunting, detection improvements, and incident investigations.
  • Share technical knowledge and assist with shift handoffs.
• Monitoring and Reporting
  • Monitor security platform performance and availability.
  • Track log collection, security alerts, and detection coverage.
  • Identify and reduce false-positive alerts.
  • Monitor security response times and system performance.
  • Prepare operational reports for different state agencies.
• Platform Maintenance and Security
  • Ensure security platforms are available and working properly.
  • Support backups, recovery, system updates, and maintenance.
  • Follow proper change management procedures.
  • Improve system reliability and performance.
• Team Collaboration
  • Work closely with security architects, engineers, SOC analysts, and state agency teams.
  • Understand business and security requirements.
  • Ensure all security solutions follow industry standards, government regulations, and organizational security policies.

Preferred Skills

• CISSP, Security+ or GIAC certification.
• Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification.