SIEM and Data Management Engineer – Managed Security

AHEAD builds platforms for digital business by combining cloud infrastructure, automation, analytics, and software delivery to support digital transformation. The SIEM and Data Management Engineer manages and improves security data capabilities for the Managed Security Team, focusing on Palo Alto Cortex XSIAM, data onboarding, ingestion pipelines, parsing, normalization, storage, and platform performance.

Responsibilities:

• Lead and perform configuration and development activities related to XSIAM data onboarding, ingestion, parsing, normalization, enrichment, and storage lifecycle management within the primary security analytics platform
• Onboard new client and internal data sources into the Managed Security SIEM environment through a variety of collection and transport methods, including API-based ingestion, syslog, agents, file-based collection, forwarders, cloud-native connectors, and other supported methods
• Develop, maintain, and tune parsers, field extractions, transformations, and normalization logic to ensure incoming telemetry is usable, consistent, and aligned to Managed Security standards
• Partner with Managed Security analysts, detection engineers, and client technical teams to define log source requirements for visibility, detection content, investigations, and reporting
• Establish and maintain data standards for source naming, field usage, tagging, metadata, categorization, and normalization across multiple client environments
• Support and optimize ingestion pipelines to ensure reliability, scale, and performance across diverse client log sources and varying data volumes
• Perform troubleshooting of data collection, transport, parser, and indexing issues, including validation of connectivity, format, mapping, field extraction, and downstream search usability
• Manage data tiering, storage allocation, retention strategies, and index lifecycle practices to ensure telemetry is retained appropriately and efficiently based on operational, contractual, and cost requirements
• Perform storage optimization and capacity planning activities within the SIEM platform to ensure ingestion remains within contracted scope while preserving the data needed for security operations and investigations
• Analyze data quality and data health across sources, including completeness, timeliness, parsing success, normalization coverage, duplication, and consistency
• Identify and implement opportunities to improve data pipeline efficiency, reduce noise, eliminate unnecessary data, and improve search and analytics performance
• Partner with SIEM, detection, and SOAR engineering resources to ensure standardized and enriched data supports dashboards, detections, automations, and incident workflows
• Build and maintain dashboards, reports, and health checks related to ingestion performance, parser quality, storage consumption, retention compliance, and onboarding progress
• Create tooling and scripts in Python or similar languages to automate onboarding checks, parser validation, data quality assessments, and platform administration tasks
• Assist with the development of processes and procedures to improve onboarding consistency, parser governance, data quality, and overall Managed Security functions
• Participate in client-facing security and technical meetings to support onboarding efforts, explain data requirements, review issues, and coordinate implementation activities

Requirements:

• Experience with Palo Alto Networks Cortex XSIAM, with a strong emphasis on data onboarding, data pipeline management, parsing, normalization, and platform data operations; experience with Elastic Security and its components is also valuable
• XSIAM or SIEM administration and configuration experience with a strong emphasis on data onboarding, ingestion pipelines, parsing, normalization, and storage management
• Working knowledge of common log collection and transport techniques, including API integrations, syslog, agent-based collection, file shipping, cloud connectors, webhooks, and related ingestion patterns
• Experience developing or tuning parsers, field mappings, regular expressions, transformation logic, and normalization processes for security telemetry
• Understanding of data lifecycle and storage concepts such as index lifecycle management, hot-warm-cold or tiered storage, retention strategy, archive considerations, and cost-performance tradeoffs
• Experience performing capacity planning, storage optimization, and ingestion governance in SIEM or log management platforms
• Experience writing tools to automate tasks and integrate systems in Python or another language
• The ability to think creatively to find elegant solutions to complex problems
• Excellent verbal and written communication skills
• The desire to work both independently and collaboratively with a larger team
• A willingness to be challenged along with a strong appetite for learning
• 2–4 years of experience in Information Security, SIEM engineering, data engineering for security operations, security operations, or related disciplines
• Hands-on experience with common security technologies such as firewalls, IDS, EDR, SIEM, SOAR, IAM, cloud security tools, and infrastructure platforms that generate operational and security telemetry
• Knowledge of common security analysis tools and techniques
• Understanding of common security threats, attack vectors, vulnerabilities, and exploits, and the types of telemetry required to support visibility into them
• Strong knowledge of regular expressions, structured and unstructured log formats, and data transformation concepts
• Customer service focused and portrays energy, professionalism, and welcoming characteristics
• Strong ability to work in a highly sensitive and confidential environment
• Ability to meet deadlines and handle sensitive and pressured situations
• Ability to identify issues and help develop strategy and tactical plans for various department initiatives
• Ability to use good judgment and decision-making skills
• Bachelor's Degree in Computer Science, Information Security, Engineering, or related/equivalent educational or work experience
• Experience with Palo Alto Cortex XSIAM in multi-tenant Managed Security or MSSP environments
• Experience with data onboarding and normalization across a wide variety of network, endpoint, identity, cloud, and application log sources
• Familiarity with common schemas or data models used in security analytics and event standardization
• Experience supporting detection engineering and SOC operations through improved telemetry quality and consistency
• Familiarity with automation of onboarding validation, parser testing, and data health monitoring
• One or more of the following certifications preferred: Palo Alto Networks certifications, Elastic Certified Engineer, CISSP, GCIA, GCIH, GMON, cloud certifications, or other security/data platform related credentials