Cortex Platform Engineer

We are looking for an experienced Cortex Platform Engineer with deep expertise in Palo Alto Networks’ Cortex ecosystem. The role involves hands-on, high-ownership responsibilities at the intersection of endpoint security, SOC automation, cloud security posture, and secure network access.

Requirements

• 5+ years of hands-on cybersecurity experience in SOC engineering, security operations, or endpoint/cloud security roles.
• 3+ years of direct, production experience operating Cortex XDR at enterprise scale — lab-only experience does not meet this requirement.
• Demonstrated experience with at least two additional Cortex platform components (XSOAR, XSIAM, Cortex Cloud, or Prisma Access) in a production environment.
• Proven ability to write and optimize XQL queries for threat hunting, detection tuning, and forensic investigation.
• Hands-on experience with XSOAR playbook development and integration pack management.
• Working knowledge of at least one SIEM platform (Splunk, Sentinel, or QRadar) with integration experience.
• Strong understanding of Windows, macOS, and Linux internals as they relate to endpoint telemetry, process execution, and persistence mechanisms.
• Solid grasp of the MITRE ATT&CK framework with the ability to map detections to specific techniques and sub-techniques.
• Familiarity with cloud security fundamentals across AWS, Azure, or GCP — IAM, workload security, network segmentation, and logging.
• Understanding of SASE principles, zero-trust network access concepts, and secure remote access architectures.
• Scripting competency in Python, PowerShell, or Bash for automation, log parsing, and platform integration development.

Benefits

• Generous Paid Time Off
• 401k Matching
• Retirement Plan