Key responsibilities

- Own the XSIAM architecture, onboarding roadmap, tenant governance, data strategy, integrations, retention, capacity, and service-improvement plan.

- Lead critical investigations and incident command, ensuring timely scoping, containment, recovery, stakeholder updates, and post-incident actions.

- Define standards for XQL, correlation and BIOC rules, content testing, threat hunting, incident scoring, automation, and change control.

- Architect ingestion and normalization for endpoint, identity, network, cloud, application, vulnerability, and third-party security data.

- Drive response automation across Cortex XDR, NGFW, , identity, cloud, ITSM, email, and other enterprise controls.

- Assess MITRE ATT&CK; coverage, identify telemetry and detection gaps, prioritize use cases, and validate controls through simulations and purple-team exercises.

- Lead platform upgrades, integration changes, performance optimization, data-cost governance, resilience testing, and technical escalations with the OEM.

- Mentor SOC analysts and engineers,



conduct investigation and content-quality reviews, and develop platform-specific capability plans.

- Present operational health, key risks, major incidents, KPIs, automation advantages, and roadmap status to customers and senior leadership.

Essential qualifications and expertise

- 7-11 years of cybersecurity experience with deep SIEM/XDR/SOAR expertise and at least 2 years leading teams, platforms, or managed SOC services.

- Advanced Cortex XSIAM expertise in architecture, XQL, XDR telemetry, analytics, automation, Broker VM, integrations, and content governance.

- Strong knowledge of incident response, threat hunting, malware analysis, identity attacks, network security, cloud security, and MITRE ATT&CK.;

- Proven ability to manage stakeholders, technical risks, service levels, quality, and complex delivery dependencies.

Preferred qualifications

- Palo Alto Networks Cortex certification; CISSP, CISM or equivalent.

📌 Walk-in || Deloitte_Walk-In Drive_Cyber_Gurgaon_ Cortex XSIAM Lead - Manager (Delhi)
🏢 Deloitte Shared Services India
📍 Delhi