CyberSoc Cortex XSIAM Architect

Project overview

Our client in the industrial sector is looking for a CyberSoc Cortex XSIAM Architect H/F

Mission Description:

Context

As part of a cost optimization and log collection rationalization strategy, a CyberSOC team wishes to evolve its security data collection and ingestion architecture. The objective is to better control telemetry flows sent to the SIEM, optimize collected volumes, and reduce associated costs, while maintaining a level of visibility and detection adapted to the CyberSOC's needs.

The central SIEM/XDR platform used is Palo Alto Networks Cortex XSIAM. The collection ecosystem is international and heterogeneous: Windows and Linux servers hosted in datacenters, Microsoft Azure, Microsoft 365, VMware ESXi and vCenter, SAP, Proofpoint, GitLab, Datadog, JFrog, GitHub, Imperva WAF, Cloudflare, Infoblox, Cisco ASA / ISE, as well as other data sources and security solutions.

Several Telemetry Pipeline solutions are to be studied: Cribl, Datadog Observability Pipelines, CrowdStrike Onum, and Palo Alto Networks Chronosphere.

Mission

Evaluate and select a Telemetry Pipeline solution, then integrate it into the existing architecture to efficiently centralize, normalize, filter, and route telemetry flows. The mission also includes regaining control of log collection on Microsoft Azure, optimizing data before ingestion into the SIEM, and transferring skills to operational teams.

Main Responsibilities

Technical Environment

Expected Deliverables

Profile Sought

Technical Skills

Languages

Essential Skills / Qualities:

SIEM and log management, Palo Alto Cortex XSIAM, Telemetry Pipelines, Microsoft Azure log collection, Network and server infrastructure architecture, Fluent English

• Conduct an inventory of the current collection architecture, data sources, and existing ingestion mechanisms and flows.
• Compare Telemetry Pipeline solutions based on technical, operational, financial, and security criteria.
• Define objective evaluation criteria and conduct Proofs of Concept on shortlisted solutions.
• Recommend and select the solution best suited to the CyberSOC's environment and constraints.
• Take responsibility for log collection on Microsoft Azure and optimize flows before ingestion into the SIEM.
• Integrate the chosen solution into the existing collection architecture.
• Implement mechanisms for filtering, routing, transforming, enriching, and optimizing data.
• Document the architecture, configurations, and operational procedures.
• Ensure knowledge transfer and skill development for operational teams so they can administer and maintain the solution autonomously.
• SIEM/XDR and log management: Palo Alto Networks Cortex XSIAM
• Telemetry Pipelines to evaluate: Cribl, Datadog Observability Pipelines, CrowdStrike Onum, Palo Alto Networks Chronosphere
• Cloud and collection: Microsoft Azure, Microsoft 365
• Systems and virtualization: Windows, Linux, VMware ESXi, vCenter
• Sources and security solutions: SAP, Proofpoint, GitLab, Datadog, JFrog, GitHub, Imperva WAF, Cloudflare, Infoblox, Cisco ASA / ISE
• Documented comparative analysis of the studied solutions
• Implementation and migration plan
• Target collection architecture
• Integrated and operational solution
• Complete technical and operational documentation
• Skills transfer enabling operational teams to operate the solution autonomously
• Expertise in SIEM and log management
• Mastery of Palo Alto Cortex XSIAM
• Experience with Telemetry Pipelines
• Skills in Microsoft Azure log collection
• Skills in network and server architecture and infrastructure
• Ability to produce technical documentation
• Fluent English

Nice to have

xx

Project details

Yes — 2 days/week

• Start: flexible
• Remote: hybrid
• Location: 92800 Puteaux, France, FR
• Rate: 81-81 EUR/h
• Languages: French