AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

Responsibilities:

Design and deploy SIEM architectures across on-premises, virtual, and cloud environments, including data ingestion strategy for log forwarders, syslog collectors, and cloud-native telemetry in AWS, Azure, and GCP
Configure and design data pipelines and storage tiers for retention, query performance, and compliance requirements, including sizing decisions for high-volume log environments
Create custom correlation rules and detection content (Cortex XSIAM BIOC/correlation rules, CrowdStrike NG-SIEM correlation rules, Google SecOps YARA-L rules) tailored to client environments, moving beyond out-of-box use cases to address specific threats and false-positive patterns
Develop custom dashboards and SOAR playbooks using metrics, entities, and application views, translating raw log data into views that map to client SOC workflows and executive reporting needs
Build and maintain REST API integrations between SIEM/SOAR and EDR (including CrowdStrike Falcon and Cortex XDR), firewall, ticketing, and CMDB platforms, including custom automation scripts and data enrichment configurations
Conduct security monitoring assessments for prospective and existing clients, identifying blind spots in log coverage, detection gaps, and alert fatigue drivers
Collaborate with clients to optimize and fine tune their deployment and provide guidance to assist with the optimization of the platform
Act as a technical resource for troubleshooting and resolving complex SIEM/SOAR related issues during and post-implementation
Contribute to project documentation, ensuring clarity and completeness of Solution Designs and As-Built configurations
Mentor junior consultants, sharing your SIEM/SOAR knowledge and fostering their technical development

Qualifications:

8+ years of hands-on experience with a major SIEM platform (Cortex XSIAM, CrowdStrike Next-Gen SIEM, Google SecOps, Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security) in production environments
Experience deploying and administering at least one SOAR platform (Cortex XSOAR, Google SecOps SOAR, CrowdStrike Falcon Fusion, Splunk SOAR, Microsoft Sentinel Automation, Swimlane, Tines)
Demonstrated experience deploying and tuning log ingestion pipelines, indexers, and storage tiers, including sizing, retention configuration, and performance troubleshooting
Strong grasp of log and telemetry analysis: network, endpoint, identity, and cloud audit data sources
Experience building custom correlation rules, detections, and dashboards beyond default configurations
Proficient in Python and PowerShell scripting for automation, customization, and playbook development
Working knowledge of query languages (XQL, LogScale/CQL, YARA-L, SPL, KQL, or equivalent) and experience integrating diverse data sources into a SIEM
Experienced in proactive threat hunting and incident investigations using the MITRE ATT&CK framework, Cyber Kill Chain, NIST Cybersecurity Framework (CSF), and CIS Critical Security Controls to identify adversary TTPs and strengthen detection and response capabilities
Experience with cloud-native logging (AWS CloudTrail, Azure Monitor, GCP Audit Logs) is a strong plus
Solid understanding of network security, cloud environments, Identity, Linux, Mac, and Windows
Strong analytical and troubleshooting capabilities
Effective communication skills with the ability to engage with clients and Team members
Relevant certifications (CEH, PenTest+, Security+, CISSP, Microsoft SC-200) preferred or equivalent industry certifications are a plus

The compensation range indicated in this posting reflects the On-Target Earnings (“OTE”) for this role, which includes a base salary and any applicable target bonus amount. This OTE range may vary based on the candidate’s relevant experience, qualifications, and geographic location.

Why AHEAD

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

USA Employment Benefits include

Medical, Dental, and Vision Insurance
401(k)
Paid company holidays
Paid time off
Paid parental and caregiver leave
Plus more! See benefits https://www.aheadbenefits.com/ for additional details.

Use of AI

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, assessing responses, or to capture recordings and create transcriptions or summaries during interviews. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please refer to the Candidate Privacy Notice or contact us at privacy@ahead.com.

You may opt-out of the review or analysis of your application and resume by AI tools by using the General Application. Please include the role you wish to apply for in the Additional Information field. You may also choose to opt-out of recording and transcription at any time, including after joining an interview. Candidates will not be penalized for choosing to opt-out.