3 days ago
Base Salary
$180k - $210k/yr
Responsibilities
- Design and deploy SIEM architectures across on-premises, virtual, and cloud environments, including log forwarders, syslog collectors, and cloud-native telemetry.
- Configure log ingestion pipelines, storage tiers, retention settings, sizing decisions, and performance optimizations for high-volume environments.
- Create custom correlation rules and detection content for Cortex XSIAM, CrowdStrike Next-Gen SIEM, and Google SecOps.
- Develop dashboards and SOAR playbooks aligned with client SOC workflows and executive reporting needs.
- Build and maintain REST API integrations among SIEM/SOAR platforms, EDR, firewalls, ticketing systems, and CMDBs.
- Conduct security monitoring assessments and identify logging blind spots, detection gaps, and alert fatigue drivers.
- Optimize client deployments and provide technical guidance during and after implementation.
- Troubleshoot complex SIEM/SOAR issues and contribute to solution design and as-built documentation.
- Mentor junior consultants and support their technical development.
Requirements
- At least 8 years of hands-on production experience with a major SIEM platform such as Cortex XSIAM, CrowdStrike Next-Gen SIEM, Google SecOps, Splunk, Microsoft Sentinel, IBM QRadar, or Elastic Security.
- Experience deploying and administering at least one SOAR platform, such as Cortex XSOAR, Google SecOps SOAR, CrowdStrike Falcon Fusion, Splunk SOAR, Microsoft Sentinel Automation, Swimlane, or Tines.
- Experience deploying and tuning log ingestion pipelines, indexers, and storage tiers, including retention, sizing, and performance troubleshooting.
- Strong understanding of network, endpoint, identity, and cloud audit telemetry analysis.
- Experience creating custom correlation rules, detections, and dashboards beyond default configurations.
- Proficiency in Python and PowerShell scripting and working knowledge of query languages such as XQL, LogScale/CQL, YARA-L, SPL, and KQL.
- Experience with threat hunting and incident investigations using MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, and CIS Critical Security Controls.
- Understanding of cloud-native logging, including AWS CloudTrail, Azure Monitor, and GCP Audit Logs, is a strong plus.
- Solid understanding of network security, cloud environments, identity, Linux, macOS, and Windows.
- Strong analytical, troubleshooting, communication, and client engagement skills.
- Relevant certifications such as CEH, PenTest+, Security+, CISSP, or Microsoft SC-200 are preferred, with equivalent industry certifications also considered.
Benefits
- Medical, dental, and vision insurance.
- 401(k) plan.
- Paid company holidays and paid time off.
- Paid parental and caregiver leave.
- Certification and professional development support.
- Access to a multi-million-dollar technology lab and internal training groups.
Tech Stack
Categories
Solutions Engineering
About AHEAD
AHEAD is an IT services and consulting firm that designs, builds, and operates digital platforms for large enterprises across cloud infrastructure, automation, data and analytics, security, and DevOps. It generates revenue through consulting, systems integration, and managed services, including cloud management and operations. Founded in 2007 and headquartered in Chicago, it is privately held and owned by Centerbridge Partners.