Security Architect (SIEM Engineer)

Job Title

Security Architect – Consultant (SIEM Engineer) (14396)

Location

Columbia, SC 100% Remote

Contract Duration

12 Months

Interview Process

1–2 Rounds – Virtual/Online

Candidate Location

Nationwide – Open to candidates across the USA

Required Skills

• Bachelor's Degree in Information Technology, Information Security, or a related field; 8+ years of relevant work experience may be substituted in lieu of education.
• 5+ years of experience supporting large IT environments and/or system deployments.
• Hands-on experience with Palo Alto Cortex XSIAM and Cortex XDR design, implementation, administration, configuration, optimization, troubleshooting, and operational support.
• Experience engineering and supporting SIEM capabilities in large-scale, multi-tenant environments and 24x7 SOC operations.
• Hands-on experience with Cribl data modeling, log pipeline design, parsing, normalization, enrichment, routing, and ingestion.
• Experience developing automation, integrations, complex playbooks, and response workflows using scripting languages such as Python and Bash.
• Experience onboarding and troubleshooting telemetry from cloud, endpoint, network, identity, SaaS, Linux, Windows, and custom application sources.
• Strong understanding of enterprise security architecture, incident response, networking, access control, secure system design, and industry-standard cybersecurity frameworks.

Preferred Skills

• CISSP, Security+, or GIAC certification.
• Palo Alto Cortex, Cribl, or other relevant SIEM/security platform certification.

Key Responsibilities

• Design, deploy, administer, optimize, and troubleshoot Palo Alto Cortex XSIAM and Cortex XDR platforms.
• Support multi-tenant agency onboarding, tenant-specific configurations, role-based access controls, data segregation, dashboards, and reporting.
• Develop and tune detection rules, correlation logic, security analytics, threat-hunting queries, watchlists, and alert suppression mechanisms to reduce false positives.
• Design and maintain Cribl log pipelines, including data modeling, routing, parsing, normalization, enrichment, filtering, replay, and ingestion.
• Onboard, integrate, and monitor security telemetry across cloud, endpoint, network, identity, SaaS, and enterprise application environments.
• Optimize log ingestion volumes, retention, performance, and cost while maintaining security and compliance requirements.
• Integrate SIEM/XDR platforms with ticketing, case management, notification, identity, threat intelligence, and other enterprise systems.
• Develop and maintain automated response playbooks for enrichment, triage, containment, escalation, notification, case management, and incident response.
• Create and maintain technical documentation, including runbooks, SOPs, escalation procedures, architecture diagrams, data-flow documentation, and troubleshooting guides.
• Provide technical support to Tier 1, Tier 2, and Tier 3 SOC analysts, including detection tuning, threat hunting, incident response, troubleshooting, and operational handoffs.
• Monitor platform availability, ingestion health, detection coverage, false positives, service levels, Mean Time to Detect (MTTD), and Mean Time to Respond (MTTR).
• Ensure high availability, resilience, backup, recovery, lifecycle management, and controlled change processes for SIEM, XDR, and supporting log pipeline services.
• Collaborate with security architects, engineers, analysts, and agency stakeholders to ensure alignment with cybersecurity frameworks, regulatory requirements, and organizational security objectives.

About Us

InterSources Inc , is a Small, Woman, and Minority-Owned Business Enterprise, ISO/IEC 27001, SOC 2 Type 2 certified company with massive 18+ years of diversified experience in providing IT Consulting Services, Artificial Intelligence, Data Analysis, Application Development, Cloud Services, Cybersecurity, Digital Marketing, ERP Management, Custom Software Development, Web Development, UI/ UX Design, System Integration, QA Support etc. We make reasonable accommodations for clients and employees, and we do not discriminate based on any protected attribute including race, religion, color, national origin, gender sexual orientation, gender identity, age, or marital status. We also are a Google Cloud and Oracle partner company.