Job description

Our Mission At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place. Who We Are In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us! This role is remote, but distance is no barrier to impact. Our hybrid teams collaborate across geographies to solve big problems, stay close to our customers, and grow together. You will be part of a culture that values trust, accountability, and shared success where your work truly matters. Job Summary As the Manager of Managed XSIAM (MSIAM) SOC Engineering, you will lead, mentor, and grow a team of high-performing SOC and Detection Engineers. This is a dynamic, player-coach role that balances strategic people leadership with active technical contribution. You will drive engineering execution, steer technical strategy and playbook architecture, and jump into code alongside your team when needed. Operating at the intersection of product, engineering, and threat intelligence, you will collaborate closely with Cortex Engineering and internal Unit 42 teams to elevate detection efficacy, optimize automations, and maintain flawless operational execution. Key Responsibilities Lead & Empower: Build, mentor, and manage a high-performing team of SOC and Detection Engineers, driving career development, team retention, and operational excellence. Hands-On Technical Leadership: Remain actively involved in the engineering cycle—evaluating technical architectures, writing code (Python), designing complex automation playbooks, and ensuring overall technical quality. Content Innovation & Roadmap Expansion: Spearhead research into emerging threat landscapes, platform capabilities, and security frameworks to identify, scope, and prioritize new content packs, integrations, and automation initiatives for the team to develop. Engineering & Delivery Execution: Own end-to-end detection and playbook development workflows, maintaining accountability for team KPIs including SLA adherence, detection quality, deployment speed, and customer satisfaction. Cross-Functional Alignment: Partner closely with internal Unit 42 research teams and Cortex Engineering to translate emerging threat research into production-ready XSIAM capabilities and platform improvements. Quality Assurance & Standards: Enforce rigorous development standards across the team for staging, testing, soft implementation, and continuous tuning to maximize operational performance. Customer Escalation Support: Serve as a senior technical escalation point, stepping in on high-priority client engagements and architecture reviews when required. Qualifications Required Qualifications Management Experience: 3 years of experience directly managing security engineering or SOC teams in an enterprise or managed services environment. Total Industry Experience: 5 years of comprehensive experience across Detection Engineering, SIEM, SOAR, and EDR/XDR platforms, serving as a technical authority on SecOps infrastructure and long-term automation strategy. Advanced Engineering Rigor: Strong hands-on coding proficiency (e.g., Python) with practical experience implementing modern engineering standards, such as Detection-as-Code (DaC), CI/CD pipelines for playbook deployment, and rigorous software development lifecycles within a SOC. Deep Threat & Domain Expertise: Profound understanding of APT attack lifecycles (e.g., initial access, lateral movement, data exfiltration, persistence mechanisms) and the ability to design advanced correlation logic and automated workflows to counter highly sophisticated threat actors. Operational Mindset: Track record of driving engineering execution against defined SLAs and quality metrics while maintaining high team performance. Stakeholder Communication: Exceptional collaborative skills with the proven ability to seamlessly bridge deep technical engineering concepts with executive, client-facing, and cross-functional communication. Preferred Qualifications AI in SecOps & Automation: Practical experience leveraging AI, LLMs, or Machine Learning to enhance threat detection, streamline playbook generation, or drive efficiency in SOC workflows. Incident Response Background: Prior hands-on experience in Incident Response (IR) or Threat Hunting. Platform Expertise: Direct experience with Cortex XSIAM or Cortex XSOAR platforms. Threat Frameworks: Practical experience utilizing frameworks like MITRE ATT&CK to drive coverage mapping and detection gap analyses. Compensation Disclosure The compensation offered for this position will depend on qualifications, experience, and work location. For candidates who receive an offer at the posted level, the starting base salary (for non-sales roles) or base salary commission target (for sales/com-missioned roles) is expected to be the annual range listed below. The offered compensation may also include restricted stock units and a bonus. A description of our employee benefits may be found here . $175,400.00 - $283,800.00/yr Our Commitment We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together. We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at accommodations paloaltonetworks.com . Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics. All your information will be kept confidential according to EEO guidelines. Is role eligible for Immigration Sponsorship? No. Please note that we will not sponsor applicants for work visas for this position.

Requirements

Must-haves

Key Responsibilities Lead & Empower: Build, mentor, and manage a high-performing team of SOC and Detection Engineers, driving career development, team retention, and operational excellence.
Hands-On Technical Leadership: Remain actively involved in the engineering cycle—evaluating technical architectures, writing code (Python), designing complex automation playbooks, and ensuring overall technical quality.
Cross-Functional Alignment: Partner closely with internal Unit 42 research teams and Cortex Engineering to translate emerging threat research into production-ready XSIAM capabilities and platform improvements.
Quality Assurance & Standards: Enforce rigorous development standards across the team for staging, testing, soft implementation, and continuous tuning to maximize operational performance.
Customer Escalation Support: Serve as a senior technical escalation point, stepping in on high-priority client engagements and architecture reviews when required.
Required Qualifications Management Experience: 3 years of experience directly managing security engineering or SOC teams in an enterprise or managed services environment.
Total Industry Experience: 5 years of comprehensive experience across Detection Engineering, SIEM, SOAR, and EDR/XDR platforms, serving as a technical authority on SecOps infrastructure and long-term automation strategy.
Operational Mindset: Track record of driving engineering execution against defined SLAs and quality metrics while maintaining high team performance.
Stakeholder Communication: Exceptional collaborative skills with the proven ability to seamlessly bridge deep technical engineering concepts with executive, client-facing, and cross-functional communication.
Incident Response Background: Prior hands-on experience in Incident Response (IR) or Threat Hunting.
Platform Expertise: Direct experience with Cortex XSIAM or Cortex XSOAR platforms.
Threat Frameworks: Practical experience utilizing frameworks like MITRE ATT&CK to drive coverage mapping and detection gap analyses.
Compensation Disclosure
$175,400.00 - $283,800.00/yr
Our Commitment
We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.
All your information will be kept confidential according to EEO guidelines.
Is role eligible for Immigration Sponsorship? No. Please note that we will not sponsor applicants for work visas for this position.

Nice-to-haves

Preferred Qualifications AI in SecOps & Automation: Practical experience leveraging AI, LLMs, or Machine Learning to enhance threat detection, streamline playbook generation, or drive efficiency in SOC workflows.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aipythonci/cdmachine learning

Platform: workday
Effort: long