XSIAM Engineer

Summary:

The XSIAM Engineer is responsible for administering, maintaining, and improving Palo Alto Cortex XSIAM environments. This role supports platform operations, log and data onboarding, detection enablement, alert tuning, dashboard/report creation, and customer environment readiness. The engineer works closely with SOC, SIEM, EDR, automation, and IT teams to ensure XSIAM is stable, scalable, and operationally useful for AMDR monitoring.

Key Responsibilities:

• Onboard new data sources into Cortex XSIAM, including Syslog, API-based sources, endpoint telemetry, cloud logs, and third-party security tools.
• Configure and maintain parsing rules, field mappings, data models, and ingestion validation.
• Support detection tuning, alert logic refinement, and rule lifecycle management.
• Assist with dashboards, reports, alert views, and operational metrics.
• Validate data quality, retention, telemetry coverage, and ingestion health.
• Troubleshoot ingestion, parsing, connector, and integration issues.
• Support XSIAM use case development in partnership with SOC analysts and threat hunters.
• Maintain platform documentation, onboarding guides, data dictionaries, and engineering notes.
• Collaborate with SOC, IT, customer teams, and platform owners during onboarding and steady-state support.
• Participate in customer technical discussions, deployment readiness reviews, and operational handoffs as needed.

Required Qualifications:

• 6-10 years of hands-on experience with SIEM, XDR, SOAR, or security analytics platforms.
• Familiarity with Cortex XSIAM, Cortex XDR, Splunk, Sentinel, QRadar, or similar platforms.
• Understanding of log formats such as JSON, CEF, Syslog, and API-based data ingestion.
• Basic scripting or query experience using Python, PowerShell, Bash, XQL, SQL-like query languages, or similar.
• Familiarity with security operations, alert triage, detection logic, and incident investigation workflows.
• Strong troubleshooting, documentation, and cross-team communication skills.