Sr. MSIAM SOC Engineer (Unit 42)

Palo Alto Networks•Charlotte, NC

2d•$134,600 - $217,800•Remote

About The Position

Palo Alto Networks is hiring a Sr. MSIAM SOC Engineer for Unit 42. The role is remote and focuses on engineering and refining security detection and response capabilities in Cortex XSIAM. The engineer will maintain high standards for detection performance, accuracy, and operational relevance; translate Unit 42 threat intelligence and emerging adversary tactics, techniques, and procedures into actionable detection logic; and develop proactive automation playbooks to address anticipated security challenges and improve operational workflows. The role connects data ingestion, detection engineering, and response automation across the security lifecycle. The position requires strong customer-facing communication and the ability to guide enterprise customers through architectural and workflow decisions. Compensation depends on qualifications, experience, and work location. The expected annual base salary range is $134,600–$217,800; compensation may also include restricted stock units and a bonus. Palo Alto Networks does not offer immigration sponsorship for this position.

Requirements

At least 5 years of hands-on experience in a Senior SOC, Detection Engineering, or Security Architecture role using SIEMs, firewalls, EDR, sandboxes, and SOAR platforms.
Experience across the detection engineering lifecycle, including rule testing frameworks, soft-deployment strategies, and continuous tuning.
Experience reviewing and quality-assuring detection logic written by others and providing constructive optimization feedback.
A proactive engineering mindset and a track record of designing complex automation playbooks based on anticipated threat vectors.
Strong background in incident response and threat hunting, including translating threat intelligence into actionable defense mechanisms.
Software development experience and strong proficiency in Python for security automation.
Exceptional consultative and communication skills, with the ability to guide enterprise customers through complex architectural and workflow decisions.

Nice To Haves

Previous experience with Cortex XSIAM.

Responsibilities

Continuously refine correlation rules to ensure deployed detection logic meets standards for performance, accuracy, and operational relevance.
Translate Unit 42 threat intelligence research and emerging adversary TTPs into actionable detection logic.
Design proactive automation playbooks to address emerging security challenges and optimize operational workflows.
Architect the security lifecycle in Cortex XSIAM, connecting data ingestion, detection engineering, and response automation.
Review and quality-assure detection logic created by others, providing constructive optimization feedback.
Guide enterprise customers through complex architectural and workflow decisions.