SOC - Cyber - Cortex

Project overview

Consulting mission | International environment | Fluent English

We are looking for a senior cybersecurity engineer to modernize the security log collection for a large international group. Within the SOC team, you will manage the project end-to-end, from auditing the existing setup to deploying the collection solution.

The objective is to reduce SIEM ingestion volumes and costs while preserving SOC visibility and the detection and response capabilities of Palo Alto Cortex XSIAM. The scope covers Windows and Linux infrastructures, Microsoft Azure and Microsoft 365 cloud services, as well as network equipment and security solutions.

Your missions

To apply, please send your CV, availability, and daily rate, specifying your experience with Cortex XSIAM, Azure log collection, and telemetry pipelines.

Profile sought

Work environment

As part of the SOC team, participate in the following tasks

• Map log sources, collection mechanisms, ingestion flows, and associated volumes.
• Define criteria for comparing Telemetry Pipelines solutions in terms of technical, operational, financial, and security aspects. Conduct POCs and recommend a solution.
• Regain control of Azure log collection and optimize flows before ingestion into the SIEM.
• Design the target architecture, prepare the migration plan, and integrate the chosen solution into the existing environment.
• Implement filtering, routing, normalization, transformation, and event enrichment rules. Validate with the SOC that the data necessary for detection remains available.
• Document the architecture, configurations, and operational procedures, then train the teams to enable them to administer the solution autonomously.
• Expertise in SIEM and Log Management, with advanced experience of Palo Alto Cortex XSIAM.
• Solid experience in designing and integrating telemetry pipelines, for example with Cribl or an equivalent solution.
• Proven experience in collecting logs in Microsoft Azure.
• Mastery of network architectures and server infrastructures in a hybrid environment.
• Ability to lead a POC, justify an architectural choice, and support its production deployment.
• Fluent English, both spoken and written.
• Supervision of detection operations
• Management of cybersecurity alerts
• Implementation and optimization of detection and alert management tools

Project details

• Start: ASAP
• Duration: 12 mois
• Remote: hybrid
• Location: Paris, Île-de-France, FR
• Languages: French