DPP is seeking a
SIEM Engineer for an opportunity with our client in Columbia, SC.
Work Location: Fully remote
Duration: 12 months with possibility of extension
Terms: W2 Contract
Responsibilities: - This position is 100% remote and will participate in a monthly on-call rotation supporting a 24x7 security operations center serving multiple agencies.
- Other after-hours work may be required as needed.
- Palo Alto Cortex XSIAM and Cortex XDR platform engineering, configuration, optimization and troubleshooting.
- Multi-tenant agency onboarding, tenant-specific configuration, role-based access, data segregation, dashboards and reporting.
- Detection engineering, correlation rules, analytics, threat-hunting queries, watchlists, suppression logic and false-positive reduction.
- Cribl data modeling, log pipeline design, routing, parsing, normalization, enrichment, filtering, replay and ingestion.
- Onboarding and health monitoring of cloud, endpoint, network, identity, SaaS and custom application telemetry.
- Log volume, retention, performance and cost optimization while maintaining security and compliance requirements.
- Integrations with ticketing, case management, notification, identity, threat intelligence and other enterprise systems as needed.
- Develop, test, deploy and maintain automated response workflows and playbooks for enrichment, triage, containment, escalation, notifications, case management and incident response.
- Create and maintain operational runbooks, standard operating procedures, escalation matrices, troubleshooting guides, architecture diagrams, data-flow documentation, use-case catalogs and analyst knowledge articles.
- Support Tier 1 through Tier 3 SOC analysts and incident responders through platform troubleshooting, detection tuning, threat hunting, technical escalation, knowledge transfer and shift handoffs.
- Monitor and report on ingestion health, platform availability, alert volumes, detection coverage, false positives, service levels, mean time to detect, mean time to respond and tenant-specific operational metrics.
- Ensure high availability, resilience, backup, recovery, lifecycle management and controlled change processes for SIEM, XDR and supporting log pipeline services.
- Collaborate with security architects, engineers, analysts and agency stakeholders to align solutions with business goals, industry-standard frameworks, regulatory requirements and organizational risk tolerance.
Required Qualifications: - Hands-on Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration and operational support.
- Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center (SOC) operations.
- Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing and ingestion.
- Experience developing automation, integrations, playbooks and response workflows using scripting languages such as Python and Bash.
- Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows and custom application sources.
- Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks.
Required Education: - Bachelor's degree in information technology or information security related field.
- Eight years of relevant work experience may be substituted in lieu of education.
- Five years of experience in supporting large IT environments and/or system deployments.
Preferred Education/Certifications- CISSP, Security+ or GIAC certification.
- Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification.
Additional Skills & Duties:- Strong experience creating and managing complex playbooks.
- Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting and alert suppression logic.
- Experience supporting Tier 1 through Tier 3 SOC analysts, threat hunting, incident response and 24x7 operational handoffs.
- Familiarity with industry-standard security and compliance frameworks and experience developing playbooks, runbooks, procedures and technical documentation.
Authorized US Worker - US Citizens and those authorized to work in the US are encouraged to apply. We are unable to sponsor at this time.
Interested? Learn more:Click the
apply button to learn more about this position
(#26-01403).
DP Professionals (DPP) offers a range of compensation and benefits packages to our employees and their eligible dependents.
DPP is a certified Woman-owned Small Business Enterprise (WBE and WOSB) with more than 25 years in the staffing industry.
EOE/AA/V/D