Make an impact with NTT DATA
Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations, and for making a difference to our clients and society. Our workplace embraces diversity and inclusion – it’s a place where you can grow, belong and thrive.
Your day at NTT DATA
Role Summary
The Principal Security Platforms Engineer serves as a subject matter expert for the MSSP's Palo Alto Cortex XSIAM platform but is not limited to and associated security operations technologies. The role is responsible for the strategic evolution, architecture, engineering, automation, onboarding, Agentic AI and operational excellence of the security platforms ecosystem incl. XSIAM.
The successful candidate will provide technical leadership across platform architecture, log onboarding and normalization, detection engineering, automation, content development, integrations, and advanced troubleshooting while acting as a technical mentor and escalation point for engineering and SOC teams.
This role combines Security Architecture, Security Engineering, Detection Engineering and Automation Engineering responsibilities to ensure the security platform continuously evolves to support managed security services, threat detection, incident response and customer onboarding requirements.
Key Responsibilities
XSIAM and Other Security Platforms:
- Support the overall architecture, roadmap, and strategic evolution of the MSSP Cortex XSIAM platform and other security platforms.
- Design and maintain multi-tenant service architecture supporting managed security services customers alongside capability teams.
- Lead platform architecture reviews and recommend improvements to scalability, performance, resilience and cost optimization.
- Act as trusted advisor for onboarding, architecture, use-case development and platform optimization initiatives.
- Lead and build new service platform and automation for the SOC/security services
- Support platform upgrades, new integrations design, build and enhance, and feature adoption within XSIAM and other associated security platforms
- Act as L4 escalation support for complex platform issues such platform disruptions, ingestion failures, automation failures and detection gaps.
- Act as an advisor for the development and optimization of:
- Correlation and Suppression Rules
- Alert tuning strategies and Threat intelligence integrations
- Support to develop and maintain XQL-based use cases and detection logic.
- Support in improving the detection coverage by aligning content against MITRE ATT&CK techniques.
- Support in continuous reduction of false positives and alert fatigue.
- Review detection performance and recommend improvements based on threat trends and SOC feedback.
- Engage directly with vendor TAC and engineering teams on critical incidents.
- Provide technical leadership and guidance to SOC, Engineering, and Customer Success teams.
- Review customer requirements and recommend security monitoring strategies.
- Develop and maintain:
- Platform standards
- Engineering procedures
- Integration guides
- Document and share operational and engineering knowledge across teams. Mentor Platform, Detection, and SOC Engineers and Analysts.
- Drive technical best practices across the MSSP security engineering function.
Knowledge and Attributes
- Strong knowledge of Cortex XSIAM architecture and operations, SIEM, SOAR, XDR, detection engineering, and modern SOC practices.
- Working knowledge of Python, PowerShell, Rest APIs, KQL, and XQL.
- Deep expertise in security telemetry normalization, correlation, MITRE ATT&CK, threat detection, automation, and orchestration.
- Strong cloud security experience across Azure, AWS, and GCP. Excellent analytical, troubleshooting, consulting, stakeholder engagement, communication, mentoring, and technical leadership skills, with the ability to independently drive complex platform initiatives.
Academic Qualifications and Certifications
- Bachelor's degree in Information Technology, Cyber Security, Computer Science or related field.
- Palo Alto Networks Cortex XSIAM Engineer certification (advantageous).
- Relevant cloud security certifications across Azure, AWS or GCP.
- CISSP, CISM, CCSP or equivalent security certifications preferred.
Required Experience
- 10+ years in Cyber Security Engineering, Security Operations, or Security Architecture.
- 2+ years hands-on experience with Palo Alto Cortex XSIAM/XDR.
- Experience onboarding and normalizing SIEM/XDR telemetry and developing XQL queries, correlation rules, and detection content.
- Experience with automation, orchestration, APIs, Broker-VMs, and cloud-native integrations.
- Experience supporting MSSP or enterprise SOC environments and troubleshooting large-scale platform and ingestion issues.
- Strong knowledge of EDR/XDR, SIEM, SOAR, Threat Intelligence, Vulnerability Management, and Cloud Security.
- Experience with Python or PowerShell, REST APIs, and automation frameworks.
- Experience working with security vendors and technical support teams.
- Strong knowledge of network protocols, Linux, Windows, and cloud infrastructure.
Workplace type:
Hybrid WorkingAbout NTT DATA
NTT DATA is a $30+ billion business and technology services leader, serving 75% of the Fortune
Global 100. We are committed to accelerating client success and positively impacting society through
responsible innovation. We are one of the world’s leading AI and digital infrastructure providers, with
unmatched capabilities in enterprise-scale AI, cloud, security, connectivity, data centers and
application services. Our consulting and industry solutions help organizations and society move
confidently and sustainably into the digital future. As a Global Top Employer, we have experts in more
than 70 countries. We also offer clients access to a robust ecosystem of innovation centers as well as
established and start-up partners. NTT DATA is part of NTT Group, which invests over $3 billion each
year in R&D.
Equal Opportunity Employer
NTT DATA is proud to be an Equal Opportunity Employer with a global culture that embraces diversity. We are committed to providing an environment free of unfair discrimination and harassment. We do not discriminate based on age, race, colour, gender, sexual orientation, religion, nationality, disability, pregnancy, marital status, veteran status, or any other protected category. Join our growing global team and accelerate your career with us. Apply today.
Third parties fraudulently posing as NTT DATA recruiters
NTT DATA recruiters will never ask job seekers or candidates for payment or banking information during the recruitment process, for any reason. Please remain vigilant of third parties who may attempt to impersonate NTT DATA recruiters whether in writing or by phone in order to deceptively obtain personal data or money from you. All email communications from an NTT DATA recruiter will come from an @nttdata.com email address. If you suspect any fraudulent activity, please contact us.
Skills Required
- Bachelor’s degree or equivalent in Information Technology or a related field
- 14 or more years of experience in security
- At least 5 years of DevOps experience
- At least 5 years of Python scripting experience
- At least 5 years of KQL and XQL experience
- Extensive experience with SIEM, SOAR, EDR, XDR, CDR, cloud-native security services, and security architecture
- Extensive experience in client technical support, diagnosis, troubleshooting, and remote security technology support
- Extensive experience in SOC/CSIRT operations
- Knowledge of networking, Linux, Agentic AI/RAG, and security concepts
- Experience configuring and managing firewalls, IDS/IPS, EDR, NDR, UTM, proxies, SOAR, honeypots, and other security tools
- Knowledge of log collection mechanisms including Syslog, log files, and database APIs
- Extensive experience in security engineering
- Relevant Palo Alto XSIAM Engineer/Architect, Azure DevOps, SC-100, DW-350, DW-360, or equivalent certification
- Additional certifications such as AZ-500, CEH, CISSP, or CISM
NTT DATA Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about NTT DATA and has not been reviewed or approved by NTT DATA.
-
Fair & Transparent Compensation — Feedback suggests salary bands and grades are clearly defined, making ranges and promotion criteria easier to understand. Standardized HR processes provide visibility into levels across common delivery roles.
-
Healthcare Strength — Feedback suggests the package includes comprehensive medical, dental, and vision options with HSA/FSA eligibility. Global materials emphasize comprehensive insurance and wellbeing as baseline offerings across regions.
-
Wellbeing & Lifestyle Benefits — Flexible work options, including remote/hybrid arrangements, are highlighted as core benefits and can support work–life balance. Some delivery teams report more manageable hours than strategy consultancies, improving perceived value for time.
NTT DATA Insights
What We Do
NTT DATA, Inc. is a trusted global innovator of business and technology services. We're committed to helping clients innovate, optimize and transform for long-term success. Our R&D investments help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure, and connectivity
