Staff Security Engineer (SIEM & Data Management)

$119,000 - $192,500/Yr

Palo Alto Networks - Santa Clara, CA

Full-time - Mid Level

Santa Clara, CA

Professional, Scientific, and Technical Services

About the position

At Palo Alto Networks, we are committed to being the cybersecurity partner of choice, protecting our digital way of life. As a Staff Security Engineer specializing in SIEM and Data Management, you will play a crucial role in executing security-related data engineering programs and managing our data management and SIEM platforms. This position requires close collaboration with the Security Operations Center (SOC) and cross-functional teams to develop tools and infrastructure that enable the Information Security team to effectively prevent, detect, contain, and manage risks within the Palo Alto Networks Enterprise environment. In this fast-paced, post-startup environment, you will leverage your extensive background in managing and engineering SIEM solutions. Your responsibilities will include the design, implementation, and maintenance of all aspects of our SIEMs and their components. You will be expected to implement and manage log collection and storage solutions across various platforms, ensuring compliance with industry regulations and organizational policies. Additionally, you will review and optimize log retention policies to balance performance and compliance. Your role will also involve designing, deploying, and maintaining the organization's SIEM platforms to ensure effective monitoring and detection of potential security threats. You will develop and fine-tune SIEM rules, alerts, and dashboards to detect suspicious activities while integrating new data sources into the SIEM platform. Analyzing log and event data from multiple sources to identify patterns and potential security incidents will be a key part of your responsibilities, along with collaborating with the incident response team to investigate and mitigate security incidents. As a member of our diverse Information Security team, you will have the opportunity to mentor junior analysts, conduct training sessions on SIEM best practices, and ensure compliance with relevant industry standards. Your experience and insights will contribute to the continuous improvement of our security monitoring capabilities, making a significant impact across the organization.

Responsibilities

• Implement and manage log collection and storage solutions across various platforms, including servers, applications, and cloud services.
• Ensure logs are collected, parsed, and stored securely and comply with industry regulations and organizational policies.
• Review and optimize log retention policies and storage solutions to balance performance and compliance.
• Design, deploy, and maintain the organization's SIEM platforms to ensure effective monitoring and detection of potential security threats.
• Develop and fine-tune SIEM rules, alerts, and dashboards to detect suspicious activities and reduce false positives.
• Integrate new data sources into the SIEM platform and ensure all relevant security data is captured and analyzed.
• Analyze log and event data from multiple sources to identify patterns, anomalies, and potential security incidents.
• Perform threat hunting by proactively searching for signs of compromise or malicious activity in log data.
• Generate reports and dashboards to communicate findings to technical and non-technical stakeholders, including senior management.
• Collaborate with the incident response team to investigate and mitigate security incidents, providing insights derived from log and SIEM data.
• Provide recommendations for improvements based on incident analysis and lessons learned.
• Work closely with IT, DevOps, and other security teams to ensure the continuous improvement of security monitoring capabilities.
• Mentor junior analysts on log management, SIEM operations, and data analysis techniques.
• Conduct training sessions on SIEM best practices and incident detection strategies.
• Ensure compliance with relevant industry standards and regulations (e.g., GDPR, HIPAA, PCI-DSS) concerning log management and data retention.
• Maintain comprehensive documentation for all log management, SIEM configurations, processes, and procedures.

Requirements

• Bachelor's degree in Information Security, Computer Science, Data Analytics, or a related field, or equivalent work experience or equivalent military experience required.
• 3+ years of experience in log management, SIEM engineering, and/or data analysis in a security context.
• Experience with popular SIEM platforms such as Splunk, IBM QRadar, ArcSight, or ELK/Elastic Stack.
• Strong understanding of log management principles, including log collection, parsing, storage, and analysis.
• Proficiency in SIEM configuration, rule creation, and alert tuning.
• Solid knowledge of cybersecurity concepts, including threat detection, incident response, and vulnerability management.
• Experience with scripting languages (e.g., Python, PowerShell) for data analysis and automation.
• Familiarity with regulatory requirements and standards (e.g., FedRAMP, MLPS, NIST, PCI) related to data retention and security monitoring.
• Excellent problem-solving skills and attention to detail.
• Strong communication skills, with the ability to present complex technical information to non-technical audiences.

Benefits

• FLEXBenefits wellbeing spending account with over 1,000 eligible items selected by employees.
• Mental and financial health resources.
• Personalized learning opportunities.