SIEM Subject Matter Expert - Palo Alto Networks Cortex XSIAM

Job Description

We are seeking an experienced SIEM Subject Matter Expert with deep Palo Alto Networks Cortex XSIAM expertise for a Sydney based project.

In this hands-on delivery role, you will take end-to-end ownership of the enterprise SIEM data pipeline—from log source onboarding, parsing, and normalization through to telemetry enrichment, alert fidelity tuning, and platform health management. Combining deep technical capability with an automation mindset, you will streamline how new data sources are connected to ensure security analysts have complete, high-quality context directly within the platform.

We would look at both a contract or permanent person for this role

Key Responsibilities

• Log Source Onboarding: Onboard diverse enterprise log sources, leading log parsing, field extraction, data modeling, and normalization to common information models.

• Automation & Tooling: Design, build, and maintain automated onboarding tooling (via scripting, APIs, or native capabilities) to reduce manual effort and accelerate data connection times.

• Telemetry Enrichment: Manage enrichment pipelines that append critical context (asset ownership, identity, business criticality, and threat intelligence) to raw log events—eliminating the need for analysts to pivot between tools.

• Detection & Alert Tuning: Fine-tune SIEM configurations and detection content to measurably reduce false positives and elevate overall signal quality.

• Platform Lifecycle Management: Proactively oversee SIEM platform health, performance monitoring, capacity management, connector/collector maintenance, and platform upgrades.

Qualifications

Core Requirements:

• Cortex XSIAM Expertise: Demonstrated hands-on experience with Palo Alto Networks Cortex XSIAM, including log ingestion using Broker VMs, XDR Collectors, and custom ingestion methods.

• Data Modeling & Normalization: Proven capability developing SIEM data models, field mapping, enrichment, and schema standardization across varied enterprise data feeds.

• Automation Capability: Experience leveraging scripting, APIs, or native tools to automate log source onboarding workflows.

• Log Parsing & Query Languages: Strong proficiency in regular expressions (Regex), JSON parsing, structured log analysis, and telemetry enrichment.

• Alert Fidelity & Platform Health: A track record of optimizing detection content to reduce false positives and managing capacity, performance, and collector maintenance.

• Location & Work Rights: Must be based in Sydney (or able to work hybrid onsite in Sydney) and hold full, unrestricted Australian working rights.

Desirable Skills:

• Palo Alto Networks certifications (e.g., PCSAE or equivalent Cortex credentials).

• Proficiency in XQL or similar log query languages.

• Familiarity with the MITRE ATT&CK framework.

• Exposure to adjacent SIEM technologies (e.g., Splunk, Microsoft Sentinel, IBM QRadar).

• Prior background working within an enterprise SOC, MSSP, or complex security operations environment.

Additional Information

Why NCS?

This is a place for people who like to get stuck in, bring ideas to life and make things happen. You'll work alongside experienced people who care about what they do, contribute to meaningful work and have the support to keep learning and grow your career.  Whether you want to deepen your expertise, explore something new or take your career in a different direction, there's room to make it your own.  We value Adventure, Excellence, Integrity, Ownership and Unity - bringing curiosity, collaboration and accountability to the way we work with our clients and each other.

Ready to make extraordinary happen?

We'd love to hear from you.

We celebrate diversity and inclusion

We value different perspectives, experiences and strengths our people bring.  We're committed to an inclusive workplace where everyone has the opportunity to contribute, grow and succeed, and to providing equal employment opportunities and reasonable adjustments throughout the recruitment process.

Important information

Applicants will need valid Australian work rights and may be required to undergo relevant background, probity and police checks.

Agencies: NCS accepts candidate submissions only from agencies on our preferred supplier panel through the NCS Agency Portal.