SIEM Subject Matter Expert (Palo Alto Networks Cortex XSIAM) - Contract or Perm

We are seeking an experienced SIEM Subject Matter Expert with deep Palo Alto Networks Cortex XSIAM expertise for a Sydney based role.
In this hands-on delivery role, you will take end-to-end ownership of the enterprise SIEM data pipeline—from log source onboarding, parsing, and normalization through to telemetry enrichment, alert fidelity tuning, and platform health management. Combining deep technical capability with an automation mindset, you will streamline how new data sources are connected to ensure security analysts have complete, high-quality context directly within the platform.
We would look at both a contract or permanent person for this role
Key Responsibilities
Log Source Onboarding: Onboard diverse enterprise log sources, leading log parsing, field extraction, data modeling, and normalization to common information models.
Automation & Tooling: Design, build, and maintain automated onboarding tooling (via scripting, APIs, or native capabilities) to reduce manual effort and accelerate data connection times.
Telemetry Enrichment: Manage enrichment pipelines that append critical context (asset ownership, identity, business criticality, and threat intelligence) to raw log events—eliminating the need for analysts to pivot between tools.
Detection & Alert Tuning: Fine-tune SIEM configurations and detection content to measurably reduce false positives and elevate overall signal quality.
Platform Lifecycle Management: Proactively oversee SIEM platform health, performance monitoring, capacity management, connector/collector maintenance, and platform upgrades.
Core Requirements:
Cortex XSIAM Expertise: Demonstrated hands-on experience with Palo Alto Networks Cortex XSIAM, including log ingestion using Broker VMs, XDR Collectors, and custom ingestion methods.
Data Modeling & Normalization: Proven capability developing SIEM data models, field mapping, enrichment, and schema standardization across varied enterprise data feeds.
Automation Capability: Experience leveraging scripting, APIs, or native tools to automate log source onboarding workflows.
Log Parsing & Query Languages: Strong proficiency in regular expressions (Regex), JSON parsing, structured log analysis, and telemetry enrichment.
Alert Fidelity & Platform Health: A track record of optimizing detection content to reduce false positives and managing capacity, performance, and collector maintenance.
Location & Work Rights: Must be based in Sydney (or able to work hybrid onsite in Sydney) and hold full, unrestricted Australian working rights.
Desirable Skills:
Palo Alto Networks certifications (e.g., PCSAE or equivalent Cortex credentials).
Proficiency in XQL or similar log query languages.
Familiarity with the MITRE ATT&CK framework.
Exposure to adjacent SIEM technologies (e.g., Splunk, Microsoft Sentinel, IBM QRadar).
Prior background working within an enterprise SOC, MSSP, or complex security operations environment.

Skills
Data Modeling, Onboarding

Employment type
Full-time

Work arrangement
Hybrid