Palo Alto Networks
Principal Consultant – SOC Transformation and XSIAM Deployment
$163K–$224K
Austin, United States of America +5 · Yes · Principal · Full-time · Posted Feb 26, 2026
- Location
- Austin, United States of America
Burbank, United States of America
Seattle, United States of America
Chicago, United States of America
Atlanta, United States of America
New York City, United States of America - Experience
- 10+ years of SIEM/security analytics deployment and integration; 8+ years of SOC tooling, processes, and workflows experience.
- Visa sponsorship
- Will not sponsor applicants for work visas for this position.
About the job
Leads enterprise SOC transformation and XSIAM deployments, advising customers and delivering log migration, detection, and response capabilities.
What you'll do
- Lead customer SOC modernization programs and enterprise-scale XSIAM deployments from strategy through operationalization.
- Develop and optimize log ingestion, detection strategies, correlation rules, and response automation.
- Advise senior security leaders and build and mentor professional services teams.
What they ask for
- Track record modernizing SOCs to improve automation, AI-driven detection, and MTTD/MTTR.
- 10+ years deploying and integrating SIEM/security analytics solutions in large enterprises.
- 8+ years with SOC tooling, processes, and workflows; hands-on mastery across SIEM, SOAR, EDR, cloud security, and threat intelligence.
- Ability to develop detection and correlation rules; strong executive communication and stakeholder advisory skills; travel up to 30%.
Nice to have
- Industry-recognized certifications such as CISSP or GIAC.
- Familiarity with SIEM technologies such as Splunk and IBM QRadar.
Pay
$163,000.00 - $224,500.00/yr (base salary)
Tools
XSIAM, SIEM, SOAR, EDR, cloud security, threat intelligence, Splunk, IBM QRadar
AI focus
Leads SOC modernization using AI-driven detection and an AI-driven unified platform; improves analyst alert handling and response through automation.
Model-written summary · the original posting is authoritative