#Security #Architect - Consultant - #SIEM #Engineer

Title - #Security #Architect - Consultant - #SIEM #Engineer
ID - 12751
Client - state of South Carolina


Location - Role is 100% Remote. Preference will be given to local candidates who can come to the office as needed for client and departmental meetings, trainings, and other onsite activities.
Visa - USC, GC only due to W2 opening


Interview - -2 Rounds of Virtual Interviews. In person availability for interviews preferred.
Experience - 15+
• HANDS-ON PALO ALTO CORTEX XSIAM AND CORTEX XDR DESIGN, IMPLEMENTATION, ADMINISTRATION AND OPERATIONAL SUPPORT.
• Experience engineering and supporting SIEM capabilities for multi-tenant environments and 24x7 Security Operations Center operations.
• Experience developing and tuning detections, correlation rules, analytics, threat-hunting queries, dashboards, reporting and alert suppression logic.
• Strong experience creating and managing complex playbooks
• CRIBL DATA MODELING, LOG PIPELINE DESIGN, PARSING, NORMALIZATION, ENRICHMENT, ROUTING AND INGESTION.
• Experience developing automation, integrations, playbooks and response workflows using scripting languages such as #Python and #Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, #SaaS, #Linux, #Windows and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design and industry-standard cybersecurity frameworks.
• HANDS-ON EXPERIENCE OPERATING CORTEX XSIAM AND CORTEX XDR IN A LARGE, MULTI-TENANT ENVIRONMENT.
• Hands-on Cribl administration, data modeling and log pipeline optimization experience.
• Experience supporting Tier 1 through Tier 3 SOC analysts, threat hunting, incident response and 24x7 operational handoffs.
• Familiarity with industry-standard security and compliance frameworks and experience developing playbooks, runbooks, procedures and technical documentation.
• EIGHT YEARS OF RELEVANT WORK
• EXPERIENCE MAY BE SUBSTITUTED IN LIEU OF EDUCATION
• FIVE YEARS OF EXPERIENCE IN SUPPORTING LARGE IT ENVIRONMENTS AND/OR SYSTEM DEPLOYMENTS
• CISSP, Security+ or GIAC certification
• • Palo Alto Cortex, Cribl or other relevant SIEM/security platform certification