You'll own the technical execution of Cortex projects for our customers: standing up the platform, onboarding data sources and endpoints, tuning detections, and building automation playbooks. Once a deployment goes live, you'll also pick up operational issues for it and for other customers.
Responsibilities:
Configure and deploy Cortex XDR, XSIAM, and XSOAR, translating architecture and design decisions into a working environment
Lead endpoint agent rollout, log source and data onboarding, and integration configuration across a customer's security and IT stack
Tune detection rules and correlation logic to reduce noise and align with each customer's environment and threat profile
Build and maintain XSOAR playbooks that automate response actions and reduce manual triage work
Troubleshoot production issues across the platform: agent health, ingestion failures, integration breakage, playbook errors, and detection gaps
Write clear documentation and runbooks
Escalate to Palo Alto support channels when an issue requires vendor involvement, and manage the case through to resolution
Validate a project's technical scope against the signed SOW before kickoff, and flag gaps or risks early
Requirements:
At least 5 years of hands-on experience in security operations or security engineering, including direct, production experience deploying and operating Palo Alto Cortex (XDR, XSIAM, and/or XSOAR)
Demonstrated experience taking a Cortex deployment from initial configuration through go-live: agent rollout at scale, data source onboarding, and integration setup
Strong troubleshooting ability across Windows, Linux, and macOS endpoints, plus solid networking fundamentals
Scripting proficiency in Python and/or PowerShell, and comfort reading and modifying XSOAR playbooks
Experience integrating third-party tools and APIs into a SIEM or SOAR platform
Ability to work independently across several customer environments at once, in a project and ticket-driven delivery model rather than a single dedicated account.
Strong written documentation skills
Advantage:
Cortex XDR or XSIAM certification, or equivalent Palo Alto platform certification such as PCNSE
Prior experience delivering security projects at a systems integrator, reseller, or professional services firm, where work is scoped against a statement of work rather than an open-ended internal mandate
Familiarity with cloud platforms (AWS, Azure, or GCP) for onboarding cloud-based log sources
Exposure to Cortex Cloud or CNAPP concepts, given the ongoing convergence between Cortex and Prisma Cloud
Experience with a second SIEM or EDR platform, useful when working in mixed-vendor environments
