SIEM and Data Management Engineer – Managed Security

🕒 6 days ago

🇺🇸 United States – Remote

💵 $120k - $160k / year

⏰ Full Time

🟢 Junior

🟡 Mid-level

🚰 Data Engineer

🚫👨‍🎓 No degree required

👻 Ghost score 1%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

AHEAD

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

💼 Consulting

🤖 Artificial Intelligence

🏢 Enterprise

💰 $5.7M Venture Round - AHEAD on 2024-05

Consulting • Artificial Intelligence • Enterprise

AHEAD is a technology consulting and systems-integration firm that accelerates digital transformation by engineering integrated solutions across infrastructure, applications, data, and security. The company specializes in AI transformation and AI-enabled infrastructure, data platform and platform/workload modernization, secure and resilient architectures, operational excellence, and managed services including IT lifecycle and procurement (AHEAD Hatch) and hardware integration (AHEAD Foundry). AHEAD delivers end-to-end services from strategy and financial consulting to build and run operations, partners with major cloud and infrastructure vendors (AWS, Google Cloud, Microsoft, Cisco, Dell, VMware, NVIDIA, ServiceNow, Palo Alto Networks, Rubrik, etc. ), and serves enterprise clients across industries such as healthcare, financial services, manufacturing, retail, and public sector.

📋 Description

• Implement, maintain, and continuously improve data management capabilities supporting AHEAD’s cloud-based security analytics platforms, primarily Palo Alto Cortex XSIAM • Lead configuration and development for XSIAM data onboarding, ingestion, parsing, normalization, enrichment, and storage lifecycle management • Onboard client and internal data sources into the Managed Security SIEM using APIs, syslog, agents, file collection, forwarders, cloud connectors, and other methods • Develop, maintain, and tune parsers, field extractions, transformations, and normalization logic • Partner with Managed Security analysts, detection engineers, SIEM/SOAR engineering resources, and client technical teams • Establish data standards for source naming, fields, tagging, metadata, categorization, and normalization • Troubleshoot data collection, transport, parser, indexing, connectivity, mapping, and search usability issues • Manage data tiering, storage allocation, retention strategies, index lifecycle practices, storage optimization, and capacity planning • Analyze data quality and health, including completeness, timeliness, parsing success, normalization coverage, duplication, and consistency • Improve data pipeline efficiency, reduce noise, and optimize search and analytics performance • Build dashboards, reports, and health checks for ingestion, parser quality, storage, retention compliance, and onboarding progress • Create Python or similar-language tooling to automate onboarding checks, parser validation, data quality assessments, and platform administration • Participate in client-facing security and technical meetings to support onboarding and coordinate implementation • Provide day-to-day management of the security data platform used by the Managed Security Team in support of 24/7 SOC operations

🎯 Requirements

• Experience with Palo Alto Networks Cortex XSIAM, especially data onboarding, data pipeline management, parsing, normalization, and platform data operations • XSIAM or SIEM administration and configuration experience • Knowledge of API integrations, syslog, agent-based collection, file shipping, cloud connectors, webhooks, and related ingestion techniques • Experience developing or tuning parsers, field mappings, regular expressions, transformation logic, and normalization processes • Understanding of index lifecycle management, tiered storage, retention strategies, archiving, and cost-performance tradeoffs • Experience with capacity planning, storage optimization, and ingestion governance in SIEM or log management platforms • Experience writing automation and integration tools in Python or another language • 2–4 years of experience in Information Security, SIEM engineering, security data engineering, security operations, or related disciplines • Hands-on experience with firewalls, IDS, EDR, SIEM, SOAR, IAM, cloud security tools, and infrastructure platforms generating security telemetry • Knowledge of security analysis tools and techniques • Understanding of security threats, attack vectors, vulnerabilities, exploits, and related telemetry requirements • Strong knowledge of regular expressions, structured and unstructured log formats, and data transformation • Excellent verbal and written communication skills • Ability to work independently and collaboratively with larger teams • Ability to work in a highly sensitive and confidential environment • Ability to meet deadlines and handle sensitive, pressured situations • Ability to identify issues and develop strategic and tactical plans • Good judgment and decision-making skills • Bachelor’s Degree in Computer Science, Information Security, Engineering, or related field, or equivalent educational or work experience (preferred qualifications)

🏖️ Benefits

• Medical, Dental, and Vision Insurance • 401(k) • Paid company holidays • Paid time off • Paid parental and caregiver leave • Cross department training and development • Sponsored certifications and credentials for continued learning • Diversity and inclusion groups including Moving Women AHEAD and RISE AHEAD • AI application and interview review opt-out without penalty