Security Architect - Consultant - SIEM Engineer

DAILY DUTIES / RESPONSIBILITIES:

PRIMARILY ASSIST IN THE PLANNING, DESIGN, DEPLOYMENT, ADMINISTRATION AND OPERATIONAL SUPPORT OF ENTERPRISE SIEM AND XDR CAPABILITIES, INCLUDING:

• PALO ALTO CORTEX XSIAM AND CORTEX XDR PLATFORM ENGINEERING, CONFIGURATION, OPTIMIZATION AND TROUBLESHOOTING
• MULTI-TENANT AGENCY ONBOARDING, TENANT-SPECIFIC CONFIGURATION, ROLE-BASED ACCESS, DATA SEGREGATION, DASHBOARDS AND REPORTING
• DETECTION ENGINEERING, CORRELATION RULES, ANALYTICS, THREAT-HUNTING QUERIES, WATCHLISTS, SUPPRESSION LOGIC AND FALSE-POSITIVE REDUCTION

SECONDARILY ASSIST IN THE PLANNING, DESIGN, DEPLOYMENT AND OPERATIONAL SUPPORT OF LOG MANAGEMENT AND SECURITY DATA PIPELINES, INCLUDING:

• CRIBL DATA MODELING, LOG PIPELINE DESIGN, ROUTING, PARSING, NORMALIZATION, ENRICHMENT, FILTERING, REPLAY AND INGESTION
• ONBOARDING AND HEALTH MONITORING OF CLOUD, ENDPOINT, NETWORK, IDENTITY, SAAS AND CUSTOM APPLICATION TELEMETRY
• LOG VOLUME, RETENTION, PERFORMANCE AND COST OPTIMIZATION WHILE MAINTAINING SECURITY AND COMPLIANCE REQUIREMENTS
• INTEGRATIONS WITH TICKETING, CASE MANAGEMENT, NOTIFICATION, IDENTITY, THREAT INTELLIGENCE AND OTHER ENTERPRISE SYSTEMS AS NEEDED
• DEVELOP, TEST, DEPLOY AND MAINTAIN AUTOMATED RESPONSE WORKFLOWS AND PLAYBOOKS FOR ENRICHMENT, TRIAGE, CONTAINMENT, ESCALATION, NOTIFICATIONS, CASE MANAGEMENT AND INCIDENT RESPONSE.
• CREATE AND MAINTAIN OPERATIONAL RUNBOOKS, STANDARD OPERATING PROCEDURES, ESCALATION MATRICES, TROUBLESHOOTING GUIDES, ARCHITECTURE DIAGRAMS, DATA-FLOW DOCUMENTATION, USE-CASE CATALOGS AND ANALYST KNOWLEDGE ARTICLES.
• SUPPORT TIER 1 THROUGH TIER 3 SOC ANALYSTS AND INCIDENT RESPONDERS THROUGH PLATFORM TROUBLESHOOTING, DETECTION TUNING, THREAT HUNTING, TECHNICAL ESCALATION, KNOWLEDGE TRANSFER AND SHIFT HANDOFFS.
• MONITOR AND REPORT ON INGESTION HEALTH, PLATFORM AVAILABILITY, ALERT VOLUMES, DETECTION COVERAGE, FALSE POSITIVES, SERVICE LEVELS, MEAN TIME TO DETECT, MEAN TIME TO RESPOND AND TENANT-SPECIFIC OPERATIONAL METRICS.
• ENSURE HIGH AVAILABILITY, RESILIENCE, BACKUP, RECOVERY, LIFECYCLE MANAGEMENT AND CONTROLLED CHANGE PROCESSES FOR SIEM, XDR AND SUPPORTING LOG PIPELINE SERVICES.
• COLLABORATE WITH SECURITY ARCHITECTS, ENGINEERS, ANALYSTS AND AGENCY STAKEHOLDERS TO ALIGN SOLUTIONS WITH BUSINESS GOALS, INDUSTRY-STANDARD FRAMEWORKS, REGULATORY REQUIREMENTS AND ORGANIZATIONAL RISK TOLERANCE.

REQUIRED SKILLS (RANK IN ORDER OF IMPORTANCE):

• HANDS-ON PALO ALTO CORTEX XSIAM AND CORTEX XDR DESIGN, IMPLEMENTATION, ADMINISTRATION AND OPERATIONAL SUPPORT.
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations.
• CRIBL DATA MODELING, LOG PIPELINE DESIGN, PARSING, NORMALIZATION, ENRICHMENT, ROUTING AND INGESTION.
• Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks.

ADDITIONAL SKILLS & DUTIES:

• Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting and alert suppression logic.
• Strong experience creating and managing complex playbooks
• Familiarity with industry-standard security and compliance frameworks and experience developing playbooks, runbooks, procedures and technical documentation.
• Experience supporting Tier 1 through Tier 3 SOC analysts, threat hunting, incident response and 24x7 operational handoffs.

REQUIRED EDUCATION/CERTIFICATIONS:

• BACHELOR'S DEGREE IN AN
• INFORMATION TECHNOLOGY OR
• INFORMATION SECURITY RELATED
• FIELD
• EIGHT YEARS OF RELEVANT WORK
• EXPERIENCE MAY BE SUBSTITUTED IN LIEU OF EDUCATION
• FIVE YEARS OF EXPERIENCE IN SUPPORTING LARGE IT ENVIRONMENTS AND/OR SYSTEM DEPLOYMENTS

PREFERRED EDUCATION/CERTIFICATIONS:

• CISSP, Security+ or GIAC certification
• Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification

Benefits at IntelliBee

• Long-Term Stability: Join us on a multi-year opportunities with room to grow.
• Comprehensive Health Coverage: Access quality healthcare benefits to keep you and your family well.
• Future Planning: Enroll in our 401(k) program and invest in your financial security.
• GC Assistance: We support immediate Green Card processing, if required.