Cortex XSIAM Endpoint Security Engineer

About CYBERcom

CYBERcom is a premier cybersecurity integrator and MSSP at the forefront of the Israeli tech ecosystem. We specialize in protecting high value, mission critical environments by leveraging the world’s most advanced security platforms. As a Palo Alto Networks specialized partner, we don’t just monitor alerts, we build the automation frameworks and detection logic that define the future of SOC operations.

We believe in empowering "Rising Stars". This role is designed for an ambitious professional with a strong technical foundation who is ready to transition into a master of the Cortex XSIAM platform.

About the Role

We are looking for XSIAM/XDR Endpoint Security Engineer with approximately 2 years of experience to join our core SecOps team. You will be responsible for the "engine room" of our security operations: onboarding new clients, configuring cloud-native XSIAM tenants, and ensuring thousands of endpoints are hardened against modern exploits.

What You’ll Do

• Endpoint Engineering: Create, manage, and support deployments Cortex XDR agent installation packages across Windows, macOS, and Linux environments.
• Policy Optimization: Design and tune security profiles, including Malware Prevention, Exploit Protection, Restrictions, and Host Firewall settings.
• Exception Management: Manage the lifecycle of IOC/BIOC exceptions and alert exclusions to ensure high fidelity in detection.
• Infrastructure Management: Deploy and manage Broker VMs to facilitate syslog collection, local caching, and predictable traffic flow for distributed environments.
• Phased Rollouts: Execute complex agent upgrade strategies to ensure zero downtime in production environments.
• Health & Maintenance: Perform continuous health checks on data ingestion pipelines, agent operational status, and license consumption.
• Identity & Access: Configure and troubleshoot SAML/OAUTH/SSO integrations using like Okta and Azure AD, ensuring robust RBAC and user group mapping.

Qualifications

• Experience: Minimum of 1–2 years in a technical cybersecurity role (SOC Tier 2, Security Engineer, or Systems Administrator with a security focus).
• Platform Knowledge: Hands-on familiarity with Cortex XDR/XSIAM is highly preferred or Proficiency in at least one major competitor platform (CrowdStrike Falcon, MS Defender, SentinelOne, etc. for policy management).
• Technical Skills: Deep understanding of Windows/Linux OS internals and networking (TCP/IP, DNS, TLS).
• Familiarity with Cloud Identity providers (Azure AD, Okta).
• Basic scripting skills (Python or PowerShell) for automation tasks.
• Certifications: Palo Alto Networks Certified SOC Analyst (PCCSA/PCNSA) or specialized XSIAM/XDR certifications are a major advantage.
• Language: High proficiency in English.

🚀 Why You’ll Love It Here

• Work at the cutting edge of the "Automation-First" SOC movement.
• Direct mentorship from senior architects and trained experts.
• Exposure to dozens of different technology stacks and organizational cultures.
• A collaborative environment that values "thinking deep" and "moving fast."