Cortex XSIAM SME

Location: Sydney – Hybrid

Employment: Contract - 6 months with opportunity of extension

Rate: $1100 per day + GST (inclusive of super)

The opportunity

We're partnering with an enterprise organisation looking for an experienced SIEM Subject Matter Expert to take ownership of engineering, automation and optimisation across its Palo Alto Cortex XSIAM environment.

This is a hands-on technical role with a strong focus on log source onboarding, telemetry enrichment and platform performance.

You'll play a key role in improving the quality of security data available to the SOC, introducing automation and reducing the manual effort required to manage and onboard new log sources.

What you'll be doing

- Lead the onboarding and integration of new log sources into Cortex XSIAM.
- Configure and maintain Broker VMs, XDR Collectors and custom ingestion methods.
- Develop automation to streamline log collection, parsing and integration.
- Improve data normalisation, field mapping and telemetry enrichment.
- Integrate asset, identity and threat intelligence context into security events.
- Tune detection content to reduce false positives and improve alert accuracy.
- Maintain SIEM performance, connector health, capacity and platform upgrades.




- Work closely with SOC and security engineering teams to improve detection capabilities.

What we're looking for

- Robust hands-on experience engineering Palo Alto Cortex XSIAM environments.
- Proven experience implementing log source onboarding and ingestion pipelines.
- Strong understanding of SIEM data modelling, parsing and normalisation.
- Experience with Broker VMs, XDR Collectors and Cortex integrations.
- Automation experience using scripting, APIs or platform-native capabilities.
- Experience tuning SIEM detections and improving alert fidelity.
- Knowledge of JSON, regex and structured log analysis.

Experience with Splunk, Microsoft Sentinel, QRadar, XQL or MITRE ATT&CK; would be advantageous. Why consider this opportunity? You'll have the opportunity to take technical ownership of an enterprise SIEM environment, drive automation and improve security detection capabilities.

This is ideal for someone who enjoys building and optimising SIEM platforms rather than working solely in security monitoring or incident response.

Interested?

Apply directly or get in touch for a confidential conversation.

📌 Cortex XSIAM SME (Sydney)
🏢 TheDriveGroup
📍 Sydney