" \u003cdiv class=\"ja-job-details\"\u003e \u003ch2 class=\"title\"\u003eSenior Platform Security Engineer (SIEM)\u003c/h2\u003e \u003cdiv class=\"meta\"\u003e \u003cul class=\"classifications\"\u003e \u003cli data-id=\"20749\"\u003e IT Security \u003c/li\u003e \u003cli data-id=\"20751\"\u003e Sydney \u003c/li\u003e \u003cli data-id=\"20752\"\u003e Permanent / Full Time \u003c/li\u003e \u003c/ul\u003e \u003cp class=\"date-posted\"\u003e 1/10/2026 \u003c/p\u003e \u003c/div\u003e \u003cul class=\"bullet-points\"\u003e \u003cli\u003eUp to $190k base salary + Bonus\u003c/li\u003e \u003cli\u003eJoin a business going through a major transformation\u003c/li\u003e \u003cli\u003eLarge learning and career growth opportunity\u003c/li\u003e \u003c/ul\u003e \u003cdiv class=\"description\"\u003e We are engaged with a market leader who are investing Millions into a large scale transformation across Cyber Security. As part of their growth and renewed strategy, they have an opening for a platform engineer to come and own, manage and further build out their SIEM tool, Palo Alto Cortex XSIAM.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eThis role is for the engineers who would rather build and own the platform than sit on the alert queue. The mandate here is do it once, do it right.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eTo be clear, this is not a SOC role. You will not be triaging alerts or running incidents. You will be making sure the platform itself is doing its job.\u003cbr\u003e\u003cbr\u003e\u003cstrong\u003eWhat the role looks like:\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eOwning a modern SIEM and SOAR platform (Cortex XSIAM) across cloud and on premise components\u003c/li\u003e \u003cli\u003eOnboarding new log sources and making sure data is parsed, normalised and modelled correctly\u003c/li\u003e \u003cli\u003eBuilding custom parsers and normalisation packs for applications that do not come with them out of the box, using existing pipelines and an SDK\u003c/li\u003e \u003cli\u003eKeeping integrations and platform components healthy, current and well documented\u003c/li\u003e \u003cli\u003eWorking through requests from Cyber Defence, Threat Intel and other teams, from build through to sign off\u003c/li\u003e \u003cli\u003eHelping answer questions like \"is this application fully covered from a logging point of view?\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eWhat a good fit looks like:\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eSolid hands on experience engineering and supporting an enterprise SIEM platform (Ideally XSIAM or similar)\u003c/li\u003e \u003cli\u003eExperience with Cortex XSIAM is ideal; Google SecOps (Chronicle) or Microsoft Sentinel with real normalisation or parser work is equally worth a conversation\u003c/li\u003e \u003cli\u003eA good understanding of how data normalisation works and why it matters for detection\u003c/li\u003e \u003cli\u003eComfortable with pipelines, APIs and some scripting; Python is a bonus\u0026nbsp;\u003c/li\u003e \u003cli\u003eA clear preference for engineering and platform ownership over SOC analysis\u003c/li\u003e \u003cli\u003eManaged service or consulting backgrounds are very welcome, as long as you have delivered platform work end to end\u003c/li\u003e \u003c/ul\u003e \u003cstrong\u003eWhy this role:\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003eA genuinely new function, built with senior engineers and a hands on leader who is hiring strong talent\u003c/li\u003e \u003cli\u003eA flat team structure and a real say in how the platform is run\u003c/li\u003e \u003cli\u003eFlexible hybrid; three days in the office, and you choose which three\u003c/li\u003e \u003cli\u003eJoining at the start of a significant internal refresh, with investment behind it\u003c/li\u003e \u003c/ul\u003e If you have been doing this kind of work and want to own a platform properly, we would love to hear from you. Apply here or reach out to Craig directly at cwhyte@decipherbureau.com for a confidential chat. \u003c/div\u003e \u003cdiv class=\"apply\"\u003e \u003ca class=\"back-link\" href=\"#\" title=\"Back to search results\"\u003eBack to search results\u003c/a\u003e \u003cinput type=\"button\" class=\"ja-button\" data-job-id=\"4474941\" value=\"Apply Now\" title=\"Apply Now\" /\u003e \u003c/div\u003e \u003c/div\u003e "