[Hiring] Senior SIEM Engineer @Cynet Systems

Role Description

This position will serve as a SIEM engineer within the division of information security. The successful candidate will demonstrate extensive experience successfully designing, implementing, maintaining, and optimizing Palo Alto Cortex XSIAM and Cortex XDR in large-scale, multi-tenant security environments. The candidate will work with a large enterprise security team and a 24x7 security operations center (SOC), assisting full-time security architects, engineers, and analysts with the design, implementation, integration, and continuous improvement of SIEM, XDR, detection, and response capabilities supporting multiple client agencies.

Daily Duties / Responsibilities

• Assist in the planning, design, deployment, administration, and operational support of enterprise SIEM and XDR capabilities, including:
• Palo Alto Cortex XSIAM and Cortex XDR platform engineering
• Configuration, optimization, and troubleshooting
• Multi-tenant agency onboarding
• Tenant-specific configuration
• Role-based access and data segregation
• Dashboards, reporting, detection engineering, correlation rules
• Analytics, threat-hunting queries, watch lists, suppression logic, and false-positive reduction
• Assist in the planning, design, deployment, and operational support of log management and security data pipelines, including:
• Cribl data modeling
• Log pipeline design, routing, parsing, normalization, enrichment, filtering, replay, and ingestion onboarding
• Health monitoring of cloud, endpoint, network, identity, SaaS, and custom application telemetry log volume, retention, performance, and cost optimization
• Implement integrations with ticketing, case management, notification, identity, threat intelligence, and other enterprise systems as needed.
• Develop, test, deploy, and maintain automated response workflows and playbooks for:
• Enrichment, triage, containment, escalation, notifications, case management, and incident response
• Create and maintain operational runbooks, standard operating procedures, escalation matrices, troubleshooting guides, architecture diagrams, data-flow documentation, use-case catalogs, and analyst knowledge articles.
• Support Tier 1 through Tier 3 SOC analysts and incident responders through:
• Platform troubleshooting
• Detection tuning
• Threat hunting
• Technical escalation, knowledge transfer, and shift handoffs
• Monitor and report on:
• Ingestion health
• Platform availability
• Alert volumes
• Detection coverage
• False positives
• Service levels
• Mean time to detect
• Mean time to respond
• Tenant-specific operational metrics
• Ensure high availability, resilience, backup, recovery, lifecycle management, and controlled change processes for SIEM, XDR, and supporting log pipeline services.
• Collaborate with security architects, engineers, analysts, and stakeholders to align solutions with business goals, industry-standard frameworks, regulatory requirements, and organizational risk tolerance.

Qualifications

• Hands-on Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, and operational support.
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations.
• Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
• Experience developing automation, integrations, playbooks, and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks.

Additional Skills & Duties

• Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting, and alert suppression logic.
• Strong experience creating and managing complex playbooks.
• Familiarity with industry-standard security and compliance frameworks and experience developing playbooks, runbooks, procedures, and technical documentation.
• Experience supporting Tier 1 through Tier 3 SOC analysts, threat hunting, incident response, and 24x7 operational handoffs.

Required Education/Certifications

• Bachelor's degree in an information technology or information security related field (8+ years of relevant work experience may be substituted in lieu of education).
• 5+ years of experience supporting large IT environments and/or system deployments.

Preferred Education/Certifications

• CISSP, Security+, or GIAC certification.
• Palo Alto Cortex, Cribl, or other relevant SIEM/security platform certification.