Key responsibilities

- Monitor XSIAM incidents and alerts, validate causality and severity, analyze attack chains, and complete evidence-based investigation records.

- Use XQL to search and correlate endpoint, network, identity, cloud, and third-party telemetry in the Cortex data lake.

- Create, test, tune, and maintain correlation rules, BIOC rules, analytics content, dashboards, reports, watchlists, and incident-scoring logic.

- Build and maintain automation and response workflows for enrichment, containment, host isolation, account actions, ticketing, and notifications.

- Onboard data through supported collectors, Broker VM, APIs, syslog, cloud integrations, and marketplace content packs; validate normalization and data quality.

- Investigate Cortex XDR endpoint telemetry, process causality chains, network stories, WildFire verdicts, identity context, and cloud activity.

- Perform proactive threat hunts mapped to MITRE ATT&CK; and convert successful hypotheses into production detections and response procedures.

- Troubleshoot ingestion, agent, integration,



query, automation, and content issues while working with infrastructure and application teams.

- Maintain runbooks, use-case documentation, rule-tuning history, incident reports, and operational metrics for service reviews.

Essential qualifications and expertise

- 5-8 years of cybersecurity experience, including at least 3 years in SOC operations, IR, SIEM/XDR, or detection engineering.

- Hands-on Cortex XSIAM or Cortex XDR experience covering XQL, incidents, causality, data onboarding, analytics, and automation.

- Solid understanding of endpoint internals, Active Directory/Entra ID, network security, cloud telemetry, malware behavior, and MITRE ATT&CK.;

- Ability to independently lead medium-to-high complexity investigations and clearly communicate technical findings.

Preferred qualifications

- Palo Alto Networks Cortex certification, Security+, CySA+, or equivalent.

📌 Walk-in || Deloitte_Walk-In Drive_Cyber_Gurgaon_ Cortex XSIAM Analyst (Delhi)
🏢 Deloitte Shared Services India
📍 Delhi