SIEM Engineer - Contract - Remote (Onsite in SC if required)

**Job Title: SIEM Engineer** **Location:** 100% Remote. Preference will be given to local candidates who can come to the office as needed for client and departmental meetings, trainings, and other onsite activities. **Interview Process:** 1-2 Rounds of Virtual Interviews. In person availability for interviews preferred. **Duration:** 12 Months **Employment Type:** Contract **Experience Required:** 10+ Years **Candidatelocation:** No South Carolina residency required. Open to nationwide candidates. All travel-related costs for onsite work will be the responsibility of the resource no matter the frequency of onsite work. **Project Scope:** We are seeking an experienced **SecurityArchitect Consultant – SIEM Engineer** to support the Department of Administration's Division of Information Security. This role is focused on the design, implementation, administration, optimization, and operational support of **Palo Alto Cortex XSIAM** and **Cortex XDR** in a large-scale, multi-tenant enterprise security environment. The successful candidate will work alongside enterprise security architects, engineers, and a 24x7 Security Operations Center (SOC) team to enhance SIEM, XDR, detection engineering, automation, incident response, and security monitoring capabilities across multiple state agencies. This role also provides secondary support for **Cribl** data pipelines, log management, and telemetry onboarding. **** **Key Responsibilities:** **** · Design, implement, configure, and maintain **Palo Alto Cortex XSIAM** and **CortexXDR** platforms. · Support multi-tenant SIEM environments, including tenant onboarding, role-based access, data segregation, dashboards, and reporting. · Develop and optimize: Detection rules, Correlation rules, Analytics, Threat hunting queries, Watchlists, Alert suppression logic · Design and manage **Cribl** log pipelines, including: Data modeling, Parsing, Normalization, Enrichment, Routing, Filtering, Replay, Log ingestion · Integrate telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom applications. · Develop and maintain automated playbooks and response workflows using Python and Bash. · Support incident response, threat hunting, and SOC operations. · Create and maintain: Runbooks, SOPs, Architecture diagrams, Data flow documentation, Knowledge articles · Support Tier 1–Tier 3 SOC analysts through troubleshooting, tuning, and knowledge transfer. · Monitor SIEM health, ingestion, availability, detection coverage, false positives, MTTD, MTTR, and operational metrics. · Ensure platform resilience, backup, recovery, lifecycle management, and change control. · Collaborate with security architects, engineers, analysts, and business stakeholders to improve enterprise security capabilities. **** **Required Skills & Experience:** - Hands-on experience with **Palo Alto Cortex XSIAM** and **Cortex XDR** architecture, implementation, administration, and operational support. - Experience supporting enterprise SIEM platforms within **large multi-tenant environments**. - Experience supporting **24x7 Security Operations Centers (SOC)**. - Strong detection engineering experience including: - Correlation rules - Threat hunting - Analytics - Dashboards - Alert tuning - False-positive reduction - Hands-on **Cribl** administration including: - Data modeling - Log pipeline design - Parsing - Normalization - Enrichment - Routing - Ingestion - Experience developing automation using: - Python - Bash - Experience onboarding cloud, endpoint, network, identity, SaaS, Windows, Linux, and custom application telemetry. - Strong knowledge of: - Enterprise security architecture - Incident response - Secure system design - Networking - Identity & Access Management - Cybersecurity frameworks **** **Preferred Skills:** · Excellent written and verbal communication skills. · Strong ability to create: Business Requirements Documents (BRD), Functional Requirements Documents (FRD), Use Cases, Process Documentation · Ex…