What are the responsibilities and job description for the SIEM Engineer position at InfoLabs inc?
We're hiring a hands-on SIEM Engineer for a public-sector security team. This is a build-and-run role centered on Palo Alto Cortex XSIAM and Cortex XDR inside a large, multi-tenant 24x7 SOC. If you live in XSIAM and XDR every day, this is your seat.
This role is remote, but you must be willing to travel to Columbia, SC and work on-site as required. U.S. Citizen or Green Card holder only. No sponsorship, and no third-party or C2C candidates.
What you'll do
- Design, deploy, administer and optimize Cortex XSIAM and Cortex XDR across a multi-tenant environment
- Build and tune detections: correlation rules, analytics, threat-hunting queries, watchlists and alert suppression to cut false positives
- Create and maintain complex playbooks and automated response workflows in Python and Bash
- Support Cribl data pipelines: parsing, normalization, enrichment, routing and ingestion
- Onboard and troubleshoot telemetry from cloud, endpoint, network, identity, SaaS, Linux and Windows sources
- Back up Tier 1 to Tier 3 SOC analysts with threat hunting, incident response and 24x7 handoffs, and join the on-call rotation
- Write runbooks, SOPs and clear technical documentation
What you need
- 9 years supporting large IT and security environments
- Deep, hands-on Cortex XSIAM and Cortex XDR: design, implementation, administration and operations
- Strong detection engineering and complex playbook and automation experience
- Cribl data modeling and log pipeline experience
- Python and Bash scripting
- Solid grounding in enterprise security architecture, incident response, networking and access control
- Bachelor's in an IT or Information Security field, or equivalent experience
- Nice to have: CISSP, Security , GIAC, or a Palo Alto Cortex or Cribl certification
Work authorization
- U.S. Citizen or Green Card holder only. No sponsorship, and no third-party or C2C candidates.
Background and screening - please read
This is a government security role, so the vetting is strict and there are no exceptions. You must pass a full criminal background check and a full credit check, a 10-panel drug screen, a driving record (MVR) check, a SLED check and E-Verify. Once on board, you must obtain and keep an annual CJIS certification.
Please apply only if you can clear all of the above and are willing to travel on-site to Columbia, SC as required.