Note: The job is a remote job and is open to candidates in USA. V Group Inc. is an IT Services company focused on providing staffing and project management services in the public sector. They are seeking a SIEM Engineer to design, implement, maintain, and optimize Palo Alto Cortex XSIAM and Cortex XDR in a multi-tenant security environment, working closely with a large enterprise security team and a 24x7 Security Operations Center.
Responsibilities
- Assist in planning, design, deployment, administration, and operational support of enterprise SIEM and XDR capabilities, including:
- Palo Alto Cortex XSIAM and Cortex XDR engineering, configuration, optimization, and troubleshooting
- Multi-tenant agency onboarding, tenant-specific configuration, role-based access, data segregation, dashboards, and reporting
- Detection engineering, correlation rules, analytics, threat-hunting queries, watchlists, suppression logic, and false-positive reduction
- Support log management and security data pipelines, including:
- Cribl data modeling, log pipeline design, routing, parsing, normalization, enrichment, filtering, replay, and ingestion
- Onboarding and monitoring telemetry from cloud, endpoint, network, identity, SaaS, and custom applications
- Log volume, retention, performance, and cost optimization while maintaining compliance
- Integrations with ticketing, case management, notification, identity, threat intelligence, and other enterprise systems
- Develop, test, deploy, and maintain automated response workflows and playbooks
- Create and maintain runbooks, SOPs, escalation matrices, troubleshooting guides, architecture diagrams, data-flow documentation, use-case catalogs, and analyst knowledge articles
- Support Tier 1–3 SOC analysts and incident responders through troubleshooting, detection tuning, threat hunting, escalation, and knowledge transfer
- Monitor and report on ingestion health, platform availability, alert volumes, detection coverage, false positives, SLAs, mean time to detect/respond, and tenant-specific metrics
- Ensure high availability, resilience, backup, recovery, lifecycle management, and controlled change processes
- Collaborate with architects, engineers, analysts, and stakeholders to align solutions with business goals, frameworks, and compliance requirements
Skills
- Hands-on Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, and support
- SIEM engineering for multi-tenant environments and 24x7 SOC operations
- Detection development and tuning (rules, analytics, threat-hunting queries, dashboards, reporting, suppression logic)
- Complex playbook creation and management
- Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion
- Automation, integrations, playbooks, and workflows using Python and Bash
- Telemetry onboarding/troubleshooting from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom apps
- Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and cybersecurity frameworks
- Bachelor's degree in IT or Information Security (or equivalent)
- Eight years of relevant work experience may substitute for education
- Five years of experience supporting large IT environments and/or system deployments
- Hands-on experience operating Cortex XSIAM and Cortex XDR in large, multi-tenant environments
- Cribl administration, data modeling, and log pipeline optimization
- Experience supporting Tier 1–3 SOC analysts, threat hunting, incident response, and operational handoffs
- Familiarity with security/compliance frameworks and experience developing playbooks, runbooks, procedures, and documentation
Company Overview
Company H1B Sponsorship