SIEM and Data Management Engineer – Managed Security

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

The Managed Security Team at AHEAD monitors client environments and performs incident detection, validation, and reporting. The SIEM and Data Management Engineer will be responsible for the implementation, maintenance, and continuous improvement of the data management capabilities that support our cloud-based security analytics platforms, with a primary focus on Palo Alto Cortex XSIAM, and the broader Managed Security program success across AHEAD. This is a technical hands-on position that requires someone with a strong understanding of the needs of a 24/7 SOC (Security Operations Center). We are looking for a candidate with XSIAM, SIEM, log management, and security data engineering experience who will work closely with the Managed Security staff and other highly technical members across multiple teams, both within AHEAD and in client environments, to continuously improve and enhance AHEAD’s Managed Security data onboarding, normalization, storage, and optimization capabilities, with Palo Alto Cortex XSIAM serving as the primary platform. Incumbents will possess strong technical and analytical skills while providing accurate analysis of security-related problems. They will have a well-rounded networking and infrastructure background and will be responsible for troubleshooting data ingestion issues, parser behavior, storage utilization, and client onboarding challenges. This individual is user focused and works to resolve client needs in a timely manner. These needs may involve onboarding new data sources, improving parsing and normalization, optimizing storage and retention strategies, and supporting the reliability and performance of the data pipelines that power Managed Security operations. The SIEM and Data Management Engineer is responsible for the day-to-day management of the security data platform used by the Managed Security Team to monitor client environments and detect security threats, with a primary emphasis on Palo Alto Cortex XSIAM and supporting familiarity with platforms such as Elastic Security. This includes data source onboarding, ingestion pipeline configuration, parser development and tuning, normalization and enrichment, data tier and retention management, storage optimization, and standardization of security telemetry across client environments. The SIEM and Data Management Engineer is expected to be familiar with a wide range of security tools and understand core security and logging fundamentals.