Security Consultant - SIEM L3

Key Responsibilities

Platform Strategy & Engineering:

• Act as the Subject Matter Expert (SME) and technical owner for the Cortex XSIAM, XSOAR, and XDR platforms.

Implement, and manage the entire Cortex ecosystem, ensuring seamless integration and data flow between XDR, XSOAR, and XSIAM.

• Lead platform upgrades, performance tuning, and capacity planning to maintain a highly available and scalable security infrastructure.
• Develop and enforce governance models, including user roles, access controls, and operational procedures.

Security Automation & Orchestration (XSOAR):

• Design and deploy sophisticated automation playbooks in XSOAR to automate incident triage, investigation, and response across the enterprise.
• Develop custom integrations using Python, REST APIs, and other methods to connect XSOAR with IT, cloud, and security systems (e.g., ITSM, Firewalls, Cloud IAM, Email Security).
• Continuously refine and optimize automation playbooks to reduce manual tasks for the SOC, minimizing Mean Time to Respond (MTTR).
• Create and maintain comprehensive documentation for all automations and integrations.

Extended Detection & Response (XDR) & Network Traffic Analysis (NTA):

Manage and optimize the Cortex XDR deployment for prevention, detection, and response across endpoints.

Configure and fine-tune the PaloAlto NTA platform to monitor network traffic, detect anomalous behavior, and identify devices.

Correlate endpoint data from XDR with network-level insights from NTA to build a multi-layered understanding of attacks.

Perform deep-dive investigations and threat hunts using the combined power of EDR and NTA telemetry.

Unified Data & Analytics (XSIAM):

• Leverage XSIAM as the central data lake for security analytics, ensuring optimal data ingestion and normalization from XDR, XSOAR, and other sources.
• Fine-tune high-fidelity detection rules using XQL (XSIAM Query Language) to identify advanced threats that span endpoints, network, and cloud.
• Exploit the integrated AI/ML capabilities within XSIAM to uncover stealthy attack patterns and perform cross-correlation analysis.

Collaboration & Leadership:

• Mentor SOC analysts and L2 engineers on effective use of the Cortex platform for investigation and response.
• Translate threat intelligence and analyst workflows into technical requirements and platform enhancements.
• Lead projects to enhance our security posture through the adoption of new Cortex features and capabilities.