Principal Security Platforms Engineer

In brief

**Overview** This role at NTT is for a Principal Security Platforms Engineer who will serve as a subject matter expert for the company's Managed Security Service Provider (MSSP) Palo Alto Cortex XSIAM platform and associated security operations technologies. The position is responsible for the strategic evolution, architecture, engineering, automation, onboarding, Agentic AI, and operational excellence of the security platforms ecosystem, including XSIAM. The successful candidate will provide technical leadership across platform architecture, log onboarding and normalization, detection engineering, automation, content development, integrations, and advanced troubleshooting. This role acts as a technical mentor and escalation point for engineering and SOC teams, combining Security Architecture, Security Engineering, Detection Engineering, and Automation Engineering responsibilities to ensure continuous platform evolution for managed security services, threat detection, incident response, and customer onboarding requirements. **What you will do** * Support the overall architecture, roadmap, and strategic evolution of the MSSP Cortex XSIAM platform and other security platforms. * Design and maintain multi-tenant service architecture supporting managed security services customers alongside capability teams. * Lead platform architecture reviews and recommend improvements to scalability, performance, resilience and cost optimization. * Act as trusted advisor for onboarding, architecture, use-case development and platform optimization initiatives. * Lead and build new service platform and automation for the SOC/security services. * Support platform upgrades, new integrations design, build and enhance, and feature adoption within XSIAM and other associated security platforms. * Act as L4 escalation support for complex platform issues such as platform disruptions, ingestion failures, automation failures and detection gaps. * Act as an advisor for the development and optimization of: * Correlation and Suppression Rules * Alert tuning strategies and Threat intelligence integrations * Support to develop and maintain XQL-based use cases and detection logic. * Support in improving the detection coverage by aligning content against MITRE ATT&CK techniques. * Support in continuous reduction of false positives and alert fatigue. * Review detection performance and recommend improvements based on threat trends and SOC feedback. * Engage directly with vendor TAC and engineering teams on critical incidents. * Provide technical leadership and guidance to SOC, Engineering, and Customer Success teams. * Review customer requirements and recommend security monitoring strategies. * Develop and maintain: * Platform standards * Engineering procedures * Integration guides * Document and share operational and engineering knowledge across teams. * Mentor Platform, Detection, and SOC Engineers and Analysts. * Drive technical best practices across the MSSP security engineering function. **Requirements (from the original advert)** * **Knowledge and Attributes:** * Strong knowledge of Cortex XSIAM architecture and operations, SIEM, SOAR, XDR, detection engineering, and modern SOC practices. * Working knowledge of Python, PowerShell, Rest APIs, KQL, and XQL. * Deep expertise in security telemetry normalization, correlation, MITRE ATT&CK, threat detection, automation, and orchestration. * Strong cloud security experience across Azure, AWS, and GCP. * Excellent analytical, troubleshooting, consulting, stakeholder engagement, communication, mentoring, and technical leadership skills, with the ability to independently drive complex platform initiatives. * **Academic Qualifications and Certifications:** * Bachelor's degree in Information Technology, Cyber Security, Computer Science or related field. * Relevant cloud security certifications across Azure, AWS or GCP. * Palo Alto Networks Cortex XSIAM Engineer certification (advantageous). * CISSP, CISM, CCSP or equivalent security certifications (preferred). * **Required Experience:** * 10+ years in Cyber Security Engineering, Security Operations, or Security Architecture. * 2+ years hands-on experience with Palo Alto Cortex XSIAM/XDR. * Experience onboarding and normalizing SIEM/XDR telemetry and developing XQL queries, correlation rules, and detection content. * Experience with automation, orchestration, APIs, Broker-VMs, and cloud-native integrations. * Experience supporting MSSP or enterprise SOC environments and troubleshooting large-scale platform and ingestion issues. * Strong knowledge of EDR/XDR, SIEM, SOAR, Threat Intelligence, Vulnerability Management, and Cloud Security. * Experience with Python or PowerShell, REST APIs, and automation frameworks. * Experience working with security vendors and technical support teams. * Strong knowledge of network protocols, Linux, Windows, and cloud infrastructure. **Who should apply** The ideal candidate is a highly experienced Principal Security Platforms Engineer with deep expertise in security platforms, particularly Palo Alto Cortex XSIAM, and associated security operations technologies. They should possess strong technical leadership skills for architecture, engineering, automation, and operational excellence of security platforms. Candidates must be capable of providing mentorship, acting as an escalation point for complex technical issues, and independently driving complex platform initiatives. Strong analytical, troubleshooting, consulting, stakeholder engagement, communication, and technical leadership abilities are essential for this role, which combines Security Architecture, Security Engineering, Detection Engineering, and Automation Engineering responsibilities. **Deadline** Not specified **Reference** Original posting: https://www.myjobmag.co.za/job/principal-security-platforms-engineer-ntt-global-networks Source: myjobmag

Summary drafted with AI assistance from the original advert. The advert itself is the authority — how we use AI.

At a glance

• Python
• AWS
• Azure
• Google Cloud
• Linux

Extracted automatically from the advert; confirm requirements on the original listing.

Job description

Before you apply

• Confirm the requirements and closing date on the original listing (myjobmag). SPANi lists vacancies from other sites and may not reflect last-minute changes.
• Legitimate employers do not charge application, registration or training fees.
• Don't send your ID or bank details before you have confirmed the employer is real.

How to spot a job scam

Before you apply

• Read the full advert and confirm you meet the minimum requirements before applying.
• Tailor your CV headline and most recent experience to the job title and key skills.
• Note the closing date and reference number, and keep a copy of what you submit.
• Apply only through the employer or job board link — never pay to apply.