Job Title:  T&T I Cyber: D&R I Assistant Manager | Security Orchestration, Automation, and Response(SOAR) | Mumb

Job Description – Senior SOC & Cortex XSOAR Administrator

Experience: 6 Years

Position: Senior SOC & Cortex XSOAR Administrator

Technology: Palo Alto Cortex XSOAR / XSIAM

Certifications: CEH and Palo Alto Cortex XSOAR / XSIAM Certification (Mandatory)

1. Role Overview

We are looking for an experienced SOC & Cortex XSOAR Administrator with approximately 6 years of experience in Cybersecurity, SOC Operations, and Security Orchestration, Automation and Response (SOAR).

The candidate will be responsible for the day-to-day administration, configuration, monitoring, maintenance, and operational management of the Palo Alto Cortex XSOAR platform. The role requires strong hands-on experience in managing security incidents, monitoring automation workflows, troubleshooting playbook executions, managing integrations, and supporting SOC operations.

The ideal candidate should have a strong understanding of SOC processes, incident response, SIEM, EDR/XDR, Threat Intelligence, and security automation.

Note: Prior experience in end-to-end Cortex XSOAR implementation, architecture design, or deployment is not mandatory. However, hands-on experience in administering and managing the platform is essential.

2. Key Responsibilities

A. Cortex XSOAR Administration

• Perform day-to-day administration and operational management of the Palo Alto Cortex XSOAR platform.
• Manage user accounts, roles, access permissions, and platform configurations.
• Monitor platform health, availability, and operational performance.
• Manage incident queues, incident assignments, classifications, and escalation workflows.
• Administer incident types, layouts, fields, classifiers, and mappers.
• Manage indicators, threat intelligence data, and enrichment activities.
• Monitor and troubleshoot integration connectivity and execution issues.
• Manage content packs, integrations, and automation configurations.
• Perform periodic platform health checks and support maintenance activities.

B. Playbook & Automation Management

• Monitor and manage the execution of existing XSOAR playbooks.
• Troubleshoot failed playbook executions, automation errors, and workflow issues.
• Configure, maintain, and update existing playbooks based on operational requirements.
• Monitor automated incident response workflows and ensure successful execution.
• Manage playbook tasks, conditions, inputs, outputs, and automation dependencies.
• Identify opportunities to improve existing automation workflows.
• Support SOC analysts in resolving playbook-related issues.

C. Integration Management

• Administer and monitor integrations between Cortex XSOAR and various security technologies.
• Troubleshoot integration failures, API connectivity issues, authentication errors, and data synchronization problems.
• Manage integration instances, configurations, credentials, and connectivity.
• Monitor the health and availability of integrations.
• Support integrations with the following technologies:
• SIEM: IBM QRadar, Splunk, Microsoft Sentinel.
• EDR/XDR: CrowdStrike Falcon, Palo Alto Cortex XDR, Microsoft Defender.
• Firewall: Palo Alto Networks, Fortinet, Check Point.
• Threat Intelligence: Palo Alto TIP, MISP, VirusTotal.
• ITSM: ServiceNow, Jira.
• Email Security: Microsoft Defender for Office 365, Proofpoint.

D. SOC Operations & Incident Management

• Strong understanding of SOC L1, L2, and L3 operational processes.
• Experience in security alert triaging, investigation, escalation, and incident response.
• Support SOC analysts in managing security incidents through Cortex XSOAR.
• Monitor automated incident enrichment, investigation, and response activities.
• Understand security use cases involving phishing, malware, suspicious IPs/domains, endpoint compromise, and account compromise.
• Ensure incident workflows operate in accordance with defined SOC processes and SLAs.
• Coordinate with SOC teams to resolve platform and operational issues.
• Understand the MITRE ATT&CK framework and its application in security operations.

E. Troubleshooting & Operational Support

• Perform troubleshooting of XSOAR platform issues, integration failures, and playbook execution errors.
• Analyze execution logs and investigate automation failures.
• Coordinate with OEM/vendor support for product-related issues.
• Support platform upgrades, patching, and maintenance activities.
• Maintain operational documentation, SOPs, and troubleshooting guides.
• Prepare periodic platform health and operational status reports.

3. Mandatory Technical Skills

• Minimum 6 years of experience in Cybersecurity / SOC Operations.
• Hands-on experience in administering and managing Palo Alto Cortex XSOAR.
• Good understanding of XSOAR architecture, components, and functionalities.
• Experience managing incidents, indicators, integrations, and playbook executions.
• Experience troubleshooting integrations and automation failures.
• Strong understanding of SOC processes and incident response lifecycle.
• Good understanding of SIEM, EDR/XDR, Threat Intelligence, and ITSM platforms.
• Basic knowledge of REST APIs, JSON, and authentication mechanisms.
• Basic scripting knowledge in Python or JavaScript.

4. Mandatory Certifications

Candidates must possess both of the following certifications:

1. Certified Ethical Hacker (CEH) – EC-Council.
2. Palo Alto Networks Cortex XSOAR / XSIAM Certification – Relevant product-specific certification.

Candidates must provide valid certification credentials during the recruitment process.

5. Good to Have

• Exposure to Cortex XSOAR upgrades and platform maintenance.
• Experience with XSOAR content packs and integration management.
• Exposure to ServiceNow, IBM QRadar, Splunk, CrowdStrike, and Palo Alto security products.
• Knowledge of MITRE ATT&CK framework.
• Experience in 24x7 SOC operational environments.

6. Key Competencies

• Strong analytical and troubleshooting skills.
• Ability to independently manage day-to-day XSOAR administration.
• Good coordination and communication skills.
• Strong ownership of platform availability and operational stability.
• Ability to work with SOC analysts and security operations teams.
• Good documentation and reporting skills.

7. Expected Candidate Profile

The candidate should be a hands-on Cortex XSOAR Administrator capable of independently managing the platform's day-to-day operations, monitoring playbook executions, managing integrations, troubleshooting operational issues, and supporting SOC teams.

The primary expectation is strong operational expertise in Palo Alto Cortex XSOAR, supported by sound SOC knowledge and relevant mandatory certifications.

Implementation Note: End-to-end Cortex XSOAR implementation, solution architecture, and deployment experience are not mandatory. The emphasis is on platform administration, operational management, troubleshooting, and SOC support.