Senior Cyber Security Engineer
Hczw Open · verified Oct 24, 2026 At a glance
Senior Security Engineering role at Hczw. Remote, United States · full-time · no salary stated · we estimate $152,500–$210,650 across the United States.
Hczw has not published a salary for this role. The figure below is our estimate, not theirs.
remoteroles summary, based on the employer's posting.
What you'll do
- Engineer Cortex XSIAM detections, correlations and analytics for endpoint, network, cloud and identity signals
- Use XQL to create detections, investigate telemetry and turn threat intelligence into MITRE ATT&CK-aligned analytics
- Adjust rules and data ingestion to improve detection accuracy and platform performance
- Build response playbooks and connect XSIAM with identity, EDR, ticketing and other enterprise tools
- Join investigations with SOC and response teams, improve the platform backlog and coach engineers and analysts
What you bring
- At least five years in security operations, detection engineering or SIEM/SOAR engineering
- Practical Cortex XSIAM experience, or strong XDR/XSOAR experience and readiness to learn XSIAM quickly
- Knowledge of SIEM/XDR, log analysis, incident response, threat detection and security automation
- Proficiency in XQL, KQL, SPL or a similar query language, plus strong scripting skills
- Experience integrating endpoint, network, cloud and identity data and operating security platforms at enterprise scale
Who this fits
This senior, hands-on role suits someone with detection or security operations experience who can guide technical work and mentor colleagues. The schedule is Monday through Friday, 8:00 to 5:00 Eastern, with a hybrid or remote arrangement in Wilmington, Delaware.
From the employer
Senior Cyber Security Engineer
Wilmington, DE
Monday – Friday 8:00 – 5:00 ET
Hybrid/Remote
We are seeking a Senior Cyber Security Engineer to play a pivotal role in advancing our detection, response, and automation capabilities across a modern enterprise security stack. In this role, you will serve as a hands-on technical leader responsible for designing, engineering, and optimizing Cortex XSIAM to deliver high-fidelity detections, scalable automation, and rapid incident response. You will work with rich telemetry spanning endpoint, network, cloud, and identity data to turn adversary behavior into actionable analytics that measurably reduce risk.
This position is ideal for an experienced detection or security operations engineer who thrives at the intersection of platform engineering and threat expertise. You will collaborate closely with SOC analysts, incident responders, and fellow engineers, influence detection strategy, and mentor others while working on creative solutions that matter at enterprise scale. You’ll have the opportunity to shape how security operations evolves, driving improvements in signal quality, automation maturity, and mean time to respond, while continuously expanding your technical depth in XSIAM, XQL, and advanced security analytics.
Some of the things you’ll be doing:
- Platform Engineering: Design, deploy, and maintain Cortex XSIAM detections, correlations, and analytics across endpoint, network, cloud, and identity data sources. Build and tune detection logic to reduce noise while improving true positive rates. Perform ongoing platform optimization, including ingest management, rule tuning, and performance improvements.
- Detection Engineering & Threat Hunting: Develop and maintain custom detections using XQL (Cortex Query Language). Conduct proactive threat hunting and investigations using XSIAM analytics and telemetry. Translate threat intelligence and adversary techniques into actionable detections aligned to MITRE ATT&CK.
- Automation & Response: Design and maintain automated response playbooks to accelerate incident containment and remediation. Integrate XSIAM with enterprise tooling (e.g., identity, EDR, ticketing, cloud, network security platforms). Support continuous improvement of MTTR through automation and orchestration.
- Operations & Collaboration: Partner with SOC analysts, incident responders, and engineering teams on investigations and response activities. Support post-go-live enhancements, backlog grooming, and technical debt reduction initiatives. Provide technical guidance and mentorship to engineers and analysts.
What technical skills, experience and qualifications do you need?
- Minimum 5+ years of experience in Security Operations, Detection Engineering, or SIEM/SOAR engineering
- Hands-on experience with Palo Alto Networks Cortex XSIAM (or strong XDR/XSOAR experience with rapid XSIAM ramp-up)
- Strong working knowledge of SIEM/XDR concepts and log analytics, incident response and threat detection workflows, and automation and orchestration use cases
- Proficiency with XQL, KQL, SPL, or similar security query languages
- Experience integrating data from endpoint, network, cloud, and identity platforms
- Strong scripting experience (Python preferred)
- Experience operating security platforms at enterprise scale
- Preferred experience with endpoint security (Cortex XDR, Defender, CrowdStrike, etc.), cloud security telemetry (AWS, Azure, GCP), identity and access logs (AD, Azure AD, IAM)
- Familiarity with MITRE ATT&CK and threat intelligence frameworks
- Experience supporting a 24/7 SOC or global security operations team
- Bachelor’s degree in computer science, information assurance, MIS or equivalent industry experience.
- Palo Alto Networks Certified XSIAM Engineer or Analyst certification preferred.
- Additional industry certifications are a plus (i.e., CEH, CISM, etc.)
#CSC #CSCCareers
Security Engineering work from LinkedIn, X, Reddit and Upwork, in one list.
Each morning you get everything that fits, strongest first.
Security EngineeringRemote
Find me workBy the team behind remoteroles.