IT - ADMIN - Security Architect - Consultant - SIEM Engineer

The hiring client is confidential; the role is within the Department of Administration’s Division of Information Security. The SIEM Engineer will support enterprise security engineering and a 24x7 SOC, primarily engineering Palo Alto Cortex XSIAM and Cortex XDR and secondarily supporting Cribl data pipelines, detection, automation, and operations.

Responsibilities:

• THIS POSITION IS 100% REMOTE AND WILL PARTICIPATE IN A MONTHLY ON-CALL ROTATION SUPPORTING A 24X7 SECURITY OPERATIONS CENTER SERVING MULTIPLE STATE AGENCIES. OTHER AFTER-HOURS WORK MAY BE REQUIRED AS NEEDED
• PRIMARILY ASSIST IN THE PLANNING, DESIGN, DEPLOYMENT, ADMINISTRATION AND OPERATIONAL SUPPORT OF ENTERPRISE SIEM AND XDR CAPABILITIES, INCLUDING:
• PALO ALTO CORTEX XSIAM AND CORTEX XDR PLATFORM ENGINEERING, CONFIGURATION, OPTIMIZATION AND TROUBLESHOOTING
• MULTI-TENANT AGENCY ONBOARDING, TENANT-SPECIFIC CONFIGURATION, ROLE-BASED ACCESS, DATA SEGREGATION, DASHBOARDS AND REPORTING
• DETECTION ENGINEERING, CORRELATION RULES, ANALYTICS, THREAT-HUNTING QUERIES, WATCHLISTS, SUPPRESSION LOGIC AND FALSE-POSITIVE REDUCTION
• SECONDARILY ASSIST IN THE PLANNING, DESIGN, DEPLOYMENT AND OPERATIONAL SUPPORT OF LOG MANAGEMENT AND SECURITY DATA PIPELINES, INCLUDING:
• CRIBL DATA MODELING, LOG PIPELINE DESIGN, ROUTING, PARSING, NORMALIZATION, ENRICHMENT, FILTERING, REPLAY AND INGESTION
• ONBOARDING AND HEALTH MONITORING OF CLOUD, ENDPOINT, NETWORK, IDENTITY, SAAS AND CUSTOM APPLICATION TELEMETRY
• LOG VOLUME, RETENTION, PERFORMANCE AND COST OPTIMIZATION WHILE MAINTAINING SECURITY AND COMPLIANCE REQUIREMENTS
• INTEGRATIONS WITH TICKETING, CASE MANAGEMENT, NOTIFICATION, IDENTITY, THREAT INTELLIGENCE AND OTHER ENTERPRISE SYSTEMS AS NEEDED
• DEVELOP, TEST, DEPLOY AND MAINTAIN AUTOMATED RESPONSE WORKFLOWS AND PLAYBOOKS FOR ENRICHMENT, TRIAGE, CONTAINMENT, ESCALATION, NOTIFICATIONS, CASE MANAGEMENT AND INCIDENT RESPONSE
• CREATE AND MAINTAIN OPERATIONAL RUNBOOKS, STANDARD OPERATING PROCEDURES, ESCALATION MATRICES, TROUBLESHOOTING GUIDES, ARCHITECTURE DIAGRAMS, DATA-FLOW DOCUMENTATION, USE-CASE CATALOGS AND ANALYST KNOWLEDGE ARTICLES
• SUPPORT TIER 1 THROUGH TIER 3 SOC ANALYSTS AND INCIDENT RESPONDERS THROUGH PLATFORM TROUBLESHOOTING, DETECTION TUNING, THREAT HUNTING, TECHNICAL ESCALATION, KNOWLEDGE TRANSFER AND SHIFT HANDOFFS
• MONITOR AND REPORT ON INGESTION HEALTH, PLATFORM AVAILABILITY, ALERT VOLUMES, DETECTION COVERAGE, FALSE POSITIVES, SERVICE LEVELS, MEAN TIME TO DETECT, MEAN TIME TO RESPOND AND TENANT-SPECIFIC OPERATIONAL METRICS
• ENSURE HIGH AVAILABILITY, RESILIENCE, BACKUP, RECOVERY, LIFECYCLE MANAGEMENT AND CONTROLLED CHANGE PROCESSES FOR SIEM, XDR AND SUPPORTING LOG PIPELINE SERVICES
• COLLABORATE WITH SECURITY ARCHITECTS, ENGINEERS, ANALYSTS AND AGENCY STAKEHOLDERS TO ALIGN SOLUTIONS WITH BUSINESS GOALS, INDUSTRY-STANDARD FRAMEWORKS, REGULATORY REQUIREMENTS AND ORGANIZATIONAL RISK TOLERANCE

Requirements:

• EXTENSIVE EXPERIENCE SUCCESSFULLY DESIGNING, IMPLEMENTING, MAINTAINING AND OPTIMIZING PALO ALTO CORTEX XSIAM AND CORTEX XDR IN LARGE-SCALE, MULTI-TENANT SECURITY ENVIRONMENTS
• HANDS-ON EXPERIENCE SUPPORTING BOTH SECURITY ENGINEERING AND SOC OPERATIONS, INCLUDING MULTI-TENANT ONBOARDING, TENANT-SPECIFIC CONFIGURATIONS, ACCESS CONTROLS, DATA SEPARATION, INTEGRATIONS, DASHBOARDS, REPORTING, INCIDENT RESPONSE, THREAT HUNTING, PLAYBOOKS, RUNBOOKS, STANDARD OPERATING PROCEDURES AND ANALYST ENABLEMENT
• THE CANDIDATE MUST BE ABLE TO SUPPORT STRATEGIC PLANNING, SOLUTION DESIGN, IMPLEMENTATION, TROUBLESHOOTING, PERFORMANCE OPTIMIZATION AND CONTINUOUS IMPROVEMENT OF SECURE SYSTEMS AND SERVICES
• ONCE ONBOARD, THEY MUST OBTAIN AND RETAIN ANNUAL CJIS CERTIFICATION AS PART OF THE ONGOING EMPLOYMENT PROCESS
• HANDS-ON PALO ALTO CORTEX XSIAM AND CORTEX XDR DESIGN, IMPLEMENTATION, ADMINISTRATION AND OPERATIONAL SUPPORT
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations
• Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting and alert suppression logic
• Strong experience creating and managing complex playbooks
• CRIBL DATA MODELING, LOG PIPELINE DESIGN, PARSING, NORMALIZATION, ENRICHMENT, ROUTING AND INGESTION
• Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks
• HANDS-ON EXPERIENCE OPERATING CORTEX XSIAM AND CORTEX XDR IN A LARGE, MULTI-TENANT ENVIRONMENT
• Hands-on Cribl administration, data modeling and log pipeline optimization experience
• Experience supporting Tier 1 through Tier 3 SOC analysts, threat hunting, incident response and 24x7 operational handoffs
• Familiarity with industry-standard security and compliance frameworks and experience developing playbooks, runbooks, procedures and technical documentation
• BACHELOR'S DEGREE IN AN INFORMATION TECHNOLOGY OR INFORMATION SECURITY RELATEDFIELD
• EIGHT YEARS OF RELEVANT WORK EXPERIENCE MAY BE SUBSTITUTED IN LIEU OF EDUCATION
• FIVE YEARS OF EXPERIENCE IN SUPPORTING LARGE IT ENVIRONMENTS AND/OR SYSTEM DEPLOYMENTS
• CISSP, Security+ or GIAC certification
• Palo Alto Cortex, Cribl or other relevant SIEM/security platform cert