Note: The job is a remote job and is open to candidates in USA. Accord Technologies Inc is seeking an experienced SIEM Engineer to design, implement, administer, and optimize enterprise security monitoring and response platforms. The role involves collaborating with security architects and engineers to enhance detection, response, and automation capabilities in a 24x7 security operations environment.
Responsibilities
- Design, deploy, configure, and maintain Cortex XSIAM
- Administer and optimize Cortex XDR capabilities
- Support enterprise SIEM architecture and operations
- Configure multi-tenant environments and tenant-specific settings
- Implement role-based access controls and data segregation
- Build and maintain dashboards, reports, and operational metrics
- Develop detection rules, correlation rules, and analytics
- Create threat-hunting queries, watchlists, and detection use cases
- Tune alerts and suppression logic to reduce false positives
- Develop and maintain automated response workflows
- Create playbooks for enrichment, triage, containment, and escalation
- Integrate SIEM/XDR platforms with ticketing and case-management tools
- Support threat-intelligence, identity, notification, and enterprise-system integrations
- Design and optimize Cribl data models and log pipelines
- Perform log routing, parsing, normalization, enrichment, filtering, replay, and ingestion
- Onboard cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom-application telemetry
- Monitor data ingestion health, platform availability, and alert volumes
- Optimize log volume, retention, platform performance, and operational costs
- Support incident response, technical escalations, and SOC analyst handoffs
- Assist Tier 1 through Tier 3 analysts with troubleshooting and detection tuning
- Create runbooks, SOPs, escalation matrices, troubleshooting guides, and architecture diagrams
- Maintain data-flow documentation, use-case catalogs, and analyst knowledge articles
- Ensure high availability, backup, recovery, lifecycle management, and controlled changes
- Apply secure-system-design principles, access controls, and cybersecurity best practices
- Use Python and Bash to develop automation, integrations, and response workflows
- Collaborate with technical and business stakeholders to align solutions with security, compliance, and risk requirements
Skills
- Deep hands-on expertise with Palo Alto Cortex XSIAM
- Deep hands-on expertise with Cortex XDR
- Deep hands-on expertise with SIEM engineering
- Deep hands-on expertise with SOC operations in large-scale, multi-tenant environments
- Strong experience with Cribl
- Strong experience with log pipelines
- Strong experience with data modeling
- Strong experience with telemetry onboarding
- Strong experience with incident response
- Strong experience with security automation using Python and Bash
- Participation in a monthly on-call rotation supporting a 24x7 security operations environment
- Occasional after-hours maintenance or incident-escalation support as needed
- Meet required background, credit, drug-screening, and ongoing security-certification requirements
- Design, deploy, configure, and maintain Cortex XSIAM
- Administer and optimize Cortex XDR capabilities
- Support enterprise SIEM architecture and operations
- Configure multi-tenant environments and tenant-specific settings
- Implement role-based access controls and data segregation
- Build and maintain dashboards, reports, and operational metrics
- Develop detection rules, correlation rules, and analytics
- Create threat-hunting queries, watchlists, and detection use cases
- Tune alerts and suppression logic to reduce false positives
- Develop and maintain automated response workflows
- Create playbooks for enrichment, triage, containment, and escalation
- Integrate SIEM/XDR platforms with ticketing and case-management tools
- Support threat-intelligence, identity, notification, and enterprise-system integrations
- Design and optimize Cribl data models and log pipelines
- Perform log routing, parsing, normalization, enrichment, filtering, replay, and ingestion
- Onboard cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom-application telemetry
- Monitor data ingestion health, platform availability, and alert volumes
- Optimize log volume, retention, platform performance, and operational costs
- Support incident response, technical escalations, and SOC analyst handoffs
- Assist Tier 1 through Tier 3 analysts with troubleshooting and detection tuning
- Create runbooks, SOPs, escalation matrices, troubleshooting guides, and architecture diagrams
- Maintain data-flow documentation, use-case catalogs, and analyst knowledge articles
- Ensure high availability, backup, recovery, lifecycle management, and controlled changes
- Apply secure-system-design principles, access controls, and cybersecurity best practices
- Use Python and Bash to develop automation, integrations, and response workflows
- Collaborate with technical and business stakeholders to align solutions with security, compliance, and risk requirements
- Bachelor s degree in IT, Information Security, or a related field preferred; relevant experience may substitute
- Preferred certifications include CISSP, Security+, GIAC, Palo Alto Cortex, Cribl, or related SIEM/security-platform credentials
Company Overview