Note: The job is a remote job and is open to candidates in USA. Tech Army, LLC is seeking an experienced Security Architect – SIEM Engineer to join a large-scale enterprise security program supporting a 24x7 Security Operations Center (SOC). This hands-on engineering role involves designing, implementing, optimizing, and automating enterprise SIEM and XDR capabilities across multiple environments.
Responsibilities
- Design, implement, administer, and optimize Palo Alto Cortex XSIAM and Cortex XDR
- Engineer enterprise SIEM solutions supporting a multi-tenant 24x7 SOC
- Develop detection logic, correlation rules, threat-hunting queries, dashboards, and reports
- Build and maintain automated incident response playbooks and security workflows
- Configure and optimize Cribl log pipelines, routing, parsing, normalization, and enrichment
- Onboard cloud, network, endpoint, identity, SaaS, and custom application telemetry
- Collaborate with security architects, SOC analysts, and incident responders to improve detection and response capabilities
- Troubleshoot platform performance, optimize data ingestion, and reduce false positives
- Create technical documentation, runbooks, SOPs, and architecture diagrams
- Participate in a monthly on-call rotation supporting a 24x7 Security Operations Center
Skills
- 5+ years of enterprise SIEM or Security Engineering experience
- Hands-on experience with Palo Alto Cortex XSIAM
- Experience administering Palo Alto Cortex XDR
- Experience supporting enterprise or multi-tenant Security Operations Centers
- Strong detection engineering and threat hunting experience
- Experience developing SIEM correlation rules and detection content
- Experience with Cribl data pipelines and log management
- Experience with Python and/or Bash scripting for automation
- Strong understanding of: Incident Response, Security Architecture, Access Controls, Enterprise Networking, Security Frameworks, Log Management
- Experience supporting Tier 1–Tier 3 SOC operations
- Cloud security experience (AWS, Azure, or GCP)
- Experience integrating security platforms with enterprise systems
- CISSP, Security+, GIAC, or equivalent certifications
- Palo Alto Cortex or Cribl certifications are highly desirable
Company Overview
Company H1B Sponsorship