Manager, MSIAM SOC Engineering

Palo Alto Networks•Remote - USA - CA, CA

20d•$175,400 - $283,800•Remote

About The Position

As the Manager of Managed XSIAM (MSIAM) SOC Engineering, you will lead, mentor, and grow a team of high-performing SOC and Detection Engineers. This is a dynamic, "player-coach" role that balances strategic people leadership with active technical contribution. You will drive engineering execution, steer technical strategy and playbook architecture, and jump into code alongside your team when needed. Operating at the intersection of product, engineering, and threat intelligence, you will collaborate closely with Cortex Engineering and internal Unit 42 teams to elevate detection efficacy, optimize automations, and maintain flawless operational execution.

Requirements

3+ years of experience directly managing security engineering or SOC teams in an enterprise or managed services environment.
5+ years of comprehensive experience across Detection Engineering, SIEM, SOAR, and EDR/XDR platforms, serving as a technical authority on SecOps infrastructure and long-term automation strategy.
Strong hands-on coding proficiency (e.g., Python) with practical experience implementing modern engineering standards, such as Detection-as-Code (DaC), CI/CD pipelines for playbook deployment, and rigorous software development lifecycles within a SOC.
Profound understanding of APT attack lifecycles (e.g., initial access, lateral movement, data exfiltration, persistence mechanisms) and the ability to design advanced correlation logic and automated workflows to counter highly sophisticated threat actors.
Track record of driving engineering execution against defined SLAs and quality metrics while maintaining high team performance.
Exceptional collaborative skills with the proven ability to seamlessly bridge deep technical engineering concepts with executive, client-facing, and cross-functional communication.

Nice To Haves

Practical experience leveraging AI, LLMs, or Machine Learning to enhance threat detection, streamline playbook generation, or drive efficiency in SOC workflows.
Prior hands-on experience in Incident Response (IR) or Threat Hunting.
Direct experience with Cortex XSIAM or Cortex XSOAR platforms.
Practical experience utilizing frameworks like MITRE ATT&CK to drive coverage mapping and detection gap analyses.

Responsibilities

Lead, mentor, and manage a high-performing team of SOC and Detection Engineers, driving career development, team retention, and operational excellence.
Remain actively involved in the engineering cycle—evaluating technical architectures, writing code (Python), designing complex automation playbooks, and ensuring overall technical quality.
Spearhead research into emerging threat landscapes, platform capabilities, and security frameworks to identify, scope, and prioritize new content packs, integrations, and automation initiatives for the team to develop.
Own end-to-end detection and playbook development workflows, maintaining accountability for team KPIs including SLA adherence, detection quality, deployment speed, and customer satisfaction.
Partner closely with internal Unit 42 research teams and Cortex Engineering to translate emerging threat research into production-ready XSIAM capabilities and platform improvements.
Enforce rigorous development standards across the team for staging, testing, soft implementation, and continuous tuning to maximize operational performance.
Serve as a senior technical escalation point, stepping in on high-priority client engagements and architecture reviews when required.