Note: The job is a remote job and is open to candidates in USA. Datasoft Technologies, Inc. is seeking a Security Architect - Consultant (SIEM Engineer) to assist the Division of Information Security. The role involves supporting large IT environments, engineering SIEM capabilities, and developing security measures to enhance operational efficiency.
Responsibilities
- Assist the Division of Information Security
- Support large IT environments and/or system deployments
- Engineer and support SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center (SOC) operations
- Develop and tune detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting, and alert suppression logic
- Create and manage complex playbooks
- Develop automation, integrations, playbooks, and response workflows using scripting languages
- Onboard and troubleshoot telemetry from various sources
- Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks
Skills
- Bachelor's Degree in Information Technology, Information Security, or a related field. (8+ years of relevant work experience may be substituted in lieu of education.)
- 5+ years of experience supporting large IT environments and/or system deployments
- Hands-on experience with Palo Alto Cortex, Cortex XSIAM, and Cortex XDR design, implementation, administration, and operational support
- Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center (SOC) operations
- Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting, and alert suppression logic
- Experience creating and managing complex playbooks
- Experience with CRIBL data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion
- Experience developing automation, integrations, playbooks, and response workflows using scripting languages such as Python and Bash
- Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources
- Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks
- CISSP, Security+, or GIAC certification
- Palo Alto Cortex, Cribl, or other relevant SIEM/Security Platform certification
- Hands-on experience operating Cortex XSIAM and Cortex XDR in a large, multi-tenant environment
- Hands-on Cribl administration, data modeling, and log pipeline optimization experience
- Experience supporting Tier 1–Tier 3 SOC Analysts, threat hunting, incident response, and 24x7 operational handoffs
- Familiarity with industry-standard security and compliance frameworks
- Experience developing playbooks, runbooks, procedures, and technical documentation
Company Overview