SYSTEMTEC is seeking a SIEM Engineer for a remote opportunity for candidates working EST hours.Candidate will design, implement, administer, and optimize enterprise SIEM and XDR solutions, primarily utilizing Palo Alto Cortex XSIAM and Cortex XDR within large-scale, multi-tenant security environments. This role will support a 24x7 Security Operations Center (SOC) by enhancing security monitoring, engineering data pipelines, developing automated response workflows, and providing technical support for multiple agency environments.
Required Qualifications of the SIEM Engineer:
- Applicants must be authorized to work for any employer in the U.S. We are unable to provide sponsorship or work with Third-Party agencies.
- Bachelor's degree in Information Technology, Information Security, or a related field; 8+ years of relevant professional experience may substitute for the degree.
- 5+ years of experience supporting enterprise IT environments, large-scale system deployments, or security infrastructure.
- Extensive hands-on experience designing, implementing, configuring, administering, and troubleshooting Palo Alto Cortex XSIAM and Cortex XDR.
- Experience engineering and supporting SIEM solutions within multi-tenant environments and 24x7 Security Operations Centers.
- Practical experience with Cribl, including data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
- Proficiency with Python, Bash, or similar scripting languages for developing security automation, integrations, playbooks, and response workflows.
- Experience onboarding and troubleshooting security telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
- Strong understanding of enterprise security architecture, incident response, network security, access controls, secure system design, and cybersecurity frameworks.
Preferred Skills/Experience of the SIEM Engineer:
- CISSP, CompTIA Security+, GIAC, or other recognized cybersecurity certifications.
- Palo Alto Cortex, Cribl, or other relevant SIEM and security platform certifications.
- Experience developing detection rules, correlation logic, threat-hunting queries, dashboards, and security analytics.
- Familiarity with security data retention, log ingestion optimization, platform performance monitoring, and automated incident response.
Responsibilities of the SIEM Engineer:
- Design, deploy, configure, maintain, and optimize Palo Alto Cortex XSIAM and Cortex XDR platforms, including multi-tenant configurations, agency onboarding, access controls, data segregation, dashboards, and reporting.
- Develop and maintain detection content, correlation rules, threat-hunting queries, analytics, and suppression logic to improve threat identification and minimize false positives.
- Engineer and support Cribl data pipelines, managing security log collection, parsing, normalization, enrichment, routing, ingestion, and performance optimization.
- Build and maintain automated security playbooks and integrations supporting alert enrichment, investigation, triage, containment, escalation, notifications, and incident response.
- Provide technical support to Tier 1 through Tier 3 SOC analysts through troubleshooting, detection tuning, threat hunting, incident escalation, documentation, and knowledge transfer.
- Monitor platform health, ingestion performance, availability, and security metrics while maintaining operational documentation, high availability, backup and recovery procedures, and compliance with security requirements.
Work Location: 100% remote; candidates may reside anywhere in the United States.
Compensation / Benefits: Full-Time Employment with SYSTEMTEC means competitive compensation, access to health, dental, disability, and life coverage, and 401(k) with match.
***Please note: SYSTEMTEC is not set up to employ workers in the states of California, New York, and New Jersey.***