SIEM Subject Matter Expert (Palo Alto Networks Cortex XSIAM) - Contract

Job description

We are seeking an experienced SIEM Subject Matter Expert with deep Palo Alto Networks Cortex XSIAM expertise for an initial 3-month contract engagement with a high likelihood of extensions , based in Sydney. In this hands-on delivery role, you will take end-to-end ownership of the enterprise SIEM data pipeline—from log source onboarding, parsing, and normalization through to telemetry enrichment, alert fidelity tuning, and platform health management. Combining deep technical capability with an automation mindset, you will streamline how new data sources are connected to ensure security analysts have complete, high-quality context directly within the platform. Key Responsibilities Log Source Onboarding: Onboard diverse enterprise log sources, leading log parsing, field extraction, data modeling, and normalization to common information models. Automation & Tooling: Design, build, and maintain automated onboarding tooling (via scripting, APIs, or native capabilities) to reduce manual effort and accelerate data connection times. Telemetry Enrichment: Manage enrichment pipelines that append critical context (asset ownership, identity, business criticality, and threat intelligence) to raw log events—eliminating the need for analysts to pivot between tools. Detection & Alert Tuning: Fine-tune SIEM configurations and detection content to measurably reduce false positives and elevate overall signal quality. Platform Lifecycle Management: Proactively oversee SIEM platform health, performance monitoring, capacity management, connector/collector maintenance, and platform upgrades. Core Requirements: Cortex XSIAM Expertise: Demonstrated hands-on experience with Palo Alto Networks Cortex XSIAM, including log ingestion using Broker VMs, XDR Collectors, and custom ingestion methods. Data Modeling & Normalization: Proven capability developing SIEM data models, field mapping, enrichment, and schema standardization across varied enterprise data feeds. Automation Capability: Experience leveraging scripting, APIs, or native tools to automate log source onboarding workflows. Log Parsing & Query Languages: Strong proficiency in regular expressions (Regex), JSON parsing, structured log analysis, and telemetry enrichment. Alert Fidelity & Platform Health: A track record of optimizing detection content to reduce false positives and managing capacity, performance, and collector maintenance. Location & Work Rights: Must be based in Sydney (or able to work hybrid onsite in Sydney) and hold full, unrestricted Australian working rights. Desirable Skills: Palo Alto Networks certifications (e.g., PCSAE or equivalent Cortex credentials). Proficiency in XQL or similar log query languages. Familiarity with the MITRE ATT&CK framework. Exposure to adjacent SIEM technologies (e.g., Splunk, Microsoft Sentinel, IBM QRadar). Prior background working within an enterprise SOC, MSSP, or complex security operations environment. Why join us: NCS Australia is where you can feel at home, nurturing your talents and skills as we make tomorrow together, one day at a time. Our benefits include paid parental leave, initiatives focused on your well-being and discounted health insurance. You will also enjoy discounts on various products and services and be regularly recognised and rewarded for high performance. We are committed to your career development through our Capability Fingerprint, industry and partner training programs, special interest groups, and an AI-driven learning platform. No matter where you are in your career, we offer meaningful work and opportunities for growth. NCS Australia is an equal-opportunity employer, and we take pride in our commitment to valuing and supporting our people and the communities we serve.We are dedicated to attracting, retaining and developing our people regardless of gender identity, ethnicity, sexual orientation, disability and age. Applications are encouraged from all sectors of the community and we strongly encourage applications from the Veterans, Aboriginal and/or Torres Strait Islander community. At NCS Australia, we are committed to supporting adjustments throughout the recruitment and selection process, as well as during employment. We actively support and encourage people with disability to apply. Agencies: We’ve got this. We request that you do not contact NCS employees outside of the Talent Acquisition team. NCS exclusively accepts resumes from agencies on our preferred supplier panel through the NCS Agency Portal. Agencies that submit resumes must have a valid fee agreement and be assigned to the particular requisition by the Talent Acquisition team. Any resumes that are submitted outside of this process will become the sole property of NCS. If a candidate is hired outside of this process, no fee or payment will be given. Work rights and background checks: To be eligible for a position with us, applicants will need to have valid work rights for Australia and be willing to undergo a comprehensive background checking process, including probity and police checks At NCS Australia, we believe in doing technology services better. Our commitment to quality, focus on people, and willingness to challenge traditional thinking set us apart. Our team brings this belief to life by partnering with our clients and communities to make tomorrow together. We are committed to creating an environment that prioritises innovation, collaboration, and purposeful work. Our diverse team is empowered to make a meaningful impact with curiosity, creativity and resilience to shape better outcomes. Join us and accept the challenge of creating a better tomorrow.