Note: The job is a remote job and is open to candidates in USA. LanceSoft, Inc. is seeking an experienced Security Architect / SIEM Engineer to support the Division of Information Security in South Carolina. The role focuses on designing and optimizing security solutions within a large-scale enterprise environment while supporting the Security Operations Center.
Responsibilities
- Design, implement, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR
- Support multi-tenant SIEM environments, including tenant onboarding, RBAC, dashboards, reporting, and data segregation
- Develop and tune detections, correlation rules, threat hunting queries, analytics, watchlists, suppression logic, and dashboards
- Design and support Cribl log pipelines, including parsing, normalization, enrichment, routing, replay, and ingestion
- Onboard and troubleshoot telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources
- Develop automation, integrations, and response playbooks using Python and Bash
- Create and maintain operational runbooks, SOPs, architecture documentation, and knowledge articles
- Support Tier 1–Tier 3 SOC analysts with troubleshooting, detection tuning, threat hunting, and incident response
- Monitor platform health, ingestion, alert volumes, detection coverage, and operational metrics
- Participate in a monthly on-call rotation supporting a 24x7 Security Operations Center
Skills
- Bachelor's degree in Information Technology, Information Security, or a related field (or 8+ years of relevant experience in lieu of a degree)
- 5+ years supporting large enterprise IT/security environments
- Hands-on experience with: Palo Alto Cortex XSIAM, Palo Alto Cortex XDR, SIEM engineering in enterprise/multi-tenant environments, 24x7 Security Operations Centers (SOC), Detection engineering, threat hunting, correlation rules, dashboards, and reporting, Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion, Python and Bash scripting for automation and integrations
- Strong understanding of enterprise security architecture, networking, access control, incident response, and cybersecurity frameworks
- Experience operating Cortex XSIAM/XDR in large enterprise environments
- Hands-on Cribl administration and log pipeline optimization
- Experience supporting Tier 1–Tier 3 SOC operations
- Experience creating playbooks, runbooks, SOPs, and technical documentation
- Certifications such as CISSP, Security+, GIAC, Palo Alto Cortex, Cribl, or other relevant security certifications
Benefits
- 100% Remote (Preference for local SC candidates for occasional onsite meetings. Travel expenses are the candidate's responsibility.)
- Duration: 12 Months (Renewable)
Company Overview
Company H1B Sponsorship