XSIAM SIEM Engineer

Our Mission

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Who We Are

In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!

Job Summary

The Cortex XSIAM SIEM Engineer is a specialized technical role within the Professional Services team. This individual will be a key player in the successful deployment and operationalization of Palo Alto Networks' Cortex XSIAM platform for our customers. The role focuses on migrating customers from legacy SIEM solutions to XSIAM, ensuring the effective ingestion and normalization of data sources, developing correlation rules, and ultimately helping customers realize the full value of their investment in our AI-driven SOC platform.

This position requires a deep understanding of traditional SIEM concepts and architectures, combined with hands-on expertise in the Cortex XSIAM platform.

Your Impact

• SIEM Migration & Deployment:

  • Lead and support the migration from customers' existing SIEM solutions (e.g., Splunk, Securonix) to Cortex XSIAM.

  • Analyze the customer's existing SIEM architecture, configuration, and rules to plan a successful transition.

  • Deploy and configure Broker VMs and other infrastructure required for log collection.

• Data Integration and Management:

  • Provide expert guidance on onboarding various third-party data sources.

  • Support customers in configuring data sources to forward logs to Cortex XSIAM.

  • Validate data ingestion and work with the customer to tune alerts, ensuring high-quality data reaches the platform.

• Correlation and Detection Development:

  • Understand customer requirements and translate pre-existing rule logic and pseudocode into XSIAM correlation rules.

  • Advise on and develop new correlation rules within XSIAM to meet customer security objectives.

  • Implement detection best practices within the XSIAM environment.

• Customer Enablement and Project Success:

  • Act as a key technical resource within the project team, working alongside the XSIAM Lead Consultant, Project Manager, and Automation Consultant.

  • Contribute to the creation of key project documents, including the Solution Design Document.

  • Participate in testing and pre-production activities to ensure a smooth go-live.

  • Assist in transitioning the customer to Business-As-Usual (BAU) operations and handing over to the appropriate long-term support teams.

Qualifications

Your Experience

• Technical Skills:

  • Detailed understanding of legacy SIEM architectures, data onboarding processes, and correlation rule logic.

  • Proven experience with major SIEM platforms such as Splunk, Securonix, Exabeam, or Elastic.

  • Hands-on experience with Cortex XSIAM, particularly in log source integration, validation, and correlation development.

  • Familiarity with endpoint security (EDR/XDR) concepts and data.

  • Knowledge of SOC operations and the challenges faced by security analysts, such as alert fatigue and manual investigation processes.

• Professional Attributes:

  • Experience in a customer-facing, consultative role, preferably within a professional services or solutions architecture team.

  • Strong analytical and problem-solving skills to address complex technical challenges during deployment.

  • Excellent communication skills, with the ability to articulate technical concepts to both technical and non-technical stakeholders.

  • Ability to work effectively as part of a distributed project team to drive successful customer outcomes. 

Our Commitment

We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.