Required skills
- SIEM
- Log Collection
- Telemetry Pipelines
- Palo Alto Cortex XSIAM
- Microsoft Azure
- Data Ingestion
- Security Architecture
Languages: French · English
Job description
For a large international industrial group, we are looking for a SIEM Engineer/Architect specializing in log collection and Telemetry Pipelines to modernize the security data collection and ingestion architecture.
Project overview
Context
For a large international industrial group, we are looking for a SIEM Engineer / Architect specialized in log collection and Telemetry Pipelines.
The group's CyberSOC wishes to modernize its security data collection and ingestion architecture. The objective is to better control the flows sent to the SIEM (Palo Alto Cortex XSIAM), optimize volumes, and reduce costs, without losing visibility or detection capabilities.
Missions
Tools & Environment
Working Conditions
Work Environment
You will join the CyberSOC of an internationally present industrial group, within the detection team. The collection scope is vast and heterogeneous: Windows and Linux servers in datacenters, Microsoft Azure and Microsoft 365, VMware ESXi and vCenter, SAP, as well as numerous SaaS solutions and network and security equipment (Proofpoint, GitLab, GitHub, Datadog, Imperva, Cloudflare, Infoblox, Cisco ASA / ISE). The central SIEM/XDR platform is Palo Alto Cortex XSIAM. Communication is in French and English.
- Conduct an inventory of the current collection architecture: sources, mechanisms, and ingestion flows.
- Lead a comparative study of Telemetry Pipeline solutions (Cribl, Datadog Observability Pipelines, CrowdStrike Onum, Chronosphere): evaluation criteria, Proof of Concept, recommendation.
- Regain control of Azure log collection and optimize flows before ingestion.
- Integrate the chosen solution into the existing architecture.
- Implement data filtering, routing, transformation, and enrichment.
- Document the architecture, configurations, and operational procedures.
- Ensure knowledge transfer to operational teams.
- Azure
- Cortex XDR
- Palo Alto
- Security Information Event Management (SIEM)
- Splunk
- Syslog
- Mission location: Paris
- Long-term mission
- 2 days of remote work per week
- Start date: ASAP
- Professional English mandatory
- Required seniority: 8 to 10 years minimum experience
Project details
- Start: flexible
- Remote: hybrid
- Location: Paris, France, FR
- Languages: French, English
Indexed by 9am's meta-search. You are a job provider? Claim or manage this listing
Found on collective.work