Remote XSIAM Automation Engineer (PANW)

Job Description

About the job

\n

StopAHack.com® is seeking a hands-on XSIAM Automation Consultant to support enterprise customers through the design, implementation, and optimization of security automation workflows within the Palo Alto Networks Cortex ecosystem .

\n

\n

Who we are

\n

StopAHack.com® is a veteran-founded cybersecurity and technology services company and a Great Place To Work® certified employer . We deliver hands-on expertise to client programs and partner-led engagements.

\n

\n

The role

\n

This is a customer-facing consulting role focused on building automation playbooks, developing custom integrations, improving SOC efficiency, and serving as a trusted advisor on Cortex XSIAM and Cortex XSOAR automation best practices. The ideal candidate has strong hands-on experience with SOAR automation, Python scripting, REST APIs, JSON workflows, SOC use cases, and technical communication with enterprise security teams.

\n

\n

What you will do

\n

\n
• Design, build, and maintain automation playbooks that improve and accelerate incident response and security operations within Cortex XSIAM
\n
• Analyze manual SOC and incident response workflows, then transform them into scalable, repeatable automation solutions
\n
• Develop and maintain custom integrations using Python to connect XSIAM with third-party security tools and internal platforms
\n
• Leverage REST APIs and JSON data structures to support orchestration across security technologies
\n
• Manage and deploy content packs, dashboards, layouts, and related automation content aligned to customer use cases
\n
• Perform health checks, troubleshooting, and optimization of integrations, automation flows, and platform content
\n
• Act as a subject matter expert on XSIAM and XSOAR automation strategy, design, and operational best practices
\n
• Partner with customer security teams to define automation roadmaps, identify opportunities for efficiency, and improve security maturity
\n
• Deliver knowledge transfer, technical workshops, and enablement sessions for customer security teams
\n
• Document designs, implementation decisions, workflows, and best practices in a clear, customer-friendly manner
\n

\n

\n

What you bring

\n

\n
• Hands-on experience building automation playbooks and managing integrations within Cortex XSOAR and/or Cortex XSIAM
\n
• Strong Python programming skills for automation, scripting, and integration development
\n
• Deep understanding of SOC workflows , incident response processes, and security operations use cases
\n
• Strong experience working with REST APIs , integrations, and JSON data handling
\n
• Ability to troubleshoot complex issues across automation workflows, integrations, and orchestration logic
\n
• Strong customer-facing communication skills with the ability to explain technical concepts clearly and effectively
\n
• Ability to operate independently and manage technical workstreams with minimal oversight
\n

\n

\n

Nice to have

\n

\n
• Experience developing or supporting automation content in enterprise security environments
\n
• Palo Alto Networks certifications such as PCNSE , PCDRA , or other XSOAR/XSIAM-related credentials
\n
• Experience advising customers on automation strategy, roadmap development, and operational maturity
\n
• Strong workshop delivery, documentation, and technical enablement experience
\n

\n

\n

Reporting and supervision

\n

\n
• This role operates as part of a consulting delivery team supporting enterprise customer environments
\n
• Candidates should be comfortable working independently while collaborating with customer stakeholders, security teams, and technical leadership
\n
• Success in this role requires strong ownership, clear communication, and the ability to drive automation workstreams from design through delivery
\n

\n

\n

Work model and hours

\n

\n
• Remote within the United States
\n
• Customer-facing consulting role supporting enterprise security programs
\n
• Standard business hours, with flexibility as needed for customer meetings, delivery milestones, and project needs
\n
• Limited client travel may be required depending on engagement needs
\n

\n

\n

Work authorization

\n

Applicants must be authorized to work in the United States without current or future sponsorship.

\n

\n

Hiring process

\n

\n
• StopAHack screening and technical interviews.
\n
• Customer or partner alignment interviews, as applicable.
\n
• Federal background checks and onboarding aligned to contract requirements.
\n
• Assignment to active projects.
\n

\n

\n

EEO and accessibility

\n

StopAHack.com® is an Equal Opportunity Employer. We consider all applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other legally protected status. If you require a reasonable accommodation during the application or interview process, contact View email address on ziprecruiter.com.

\n

\n

Note

\n

This role supports partner-led and customer-facing cybersecurity engagements involving Palo Alto Networks Cortex XSIAM and Cortex XSOAR technologies. Candidates hired for this role are employed by StopAHack.com® .