Job Summary
Job Description: Cortex XSIAM Technical Enablement Development and Delivery (FTE/Plano, TX)
Palo Alto Networks is seeking an experienced Cortex XSIAM practitioner and instructor to architect, develop, and deliver advanced learning for the Advanced XSIAM Bootcamp. In this role, you will work cross-functionally across the different teams within enablement and professional services. You will own the end-to-end lab experience for a two-week, intensive program designed to prepare partners and Professional Services engineers for field deployments. You will partner with Technical Services Practice Architects to design, validate, deliver, and continuously maintain Advanced XSIAM Bootcamp content aligned with current product capabilities and field delivery practices.
You will leverage deep practitioner-level knowledge of cybersecurity technologies and complex infrastructure—standing up multi-cloud lab environments, facilitating live technical tracks across SIEM/Endpoint and Automation, troubleshooting environments in real time, and evaluating student performance. By validating content, automating lab provisioning, and resolving issues independently, you will ensure a seamless learning experience and shape the readiness of future cybersecurity professionals.
Key Responsibilities
•Lab Infrastructure & Automation: Stand up, configure, and maintain multi-tenant GCP and Cortex XSIAM environments for concurrent instructional tracks. Automate environment provisioning, tenant resets, and teardowns using Terraform, gcloud, and custom scripts to eliminate reliance on external DevOps teams.
•Environment Validation: Perform end-to-end validation of all lab guides and exercises before Day 1. Resolve underlying defects (networking, IAM permissions, credentials, placeholder values) to ensure students can execute exercises without instructor intervention.
•Technical Development Instruction & Delivery: Architect, develop, and deliver four-day intensive lab tracks covering Automation, SIEM, and related domains both virtually and in person. Guide students through complex configurations including Broker VM clustering, Cloud Identity Engine, custom XQL parsing/data modeling, indicator mapping, playbook debugging, and agentic AI.
•Student Enablement & Support: Maintain cohort progress via scheduled check-ins, live remote-control troubleshooting, and clear explanations of internal platform mechanics (correlation latency, role constraints, hidden table fields). Distinguish between product defects and student error for timely escalation.
•Evaluation & Readiness Reporting: Score end-of-course assessments, develop capstone projects against established rubrics, and deliver detailed per-student readiness recommendations to leadership.
•Continuous Improvement: Track and log environment/content issues per cohort, update master lab guides with live session corrections, build remedial training tied to gaps and readiness, and decommission cloud assets promptly to optimize spending.
Qualifications
Required Qualifications
•5+ years of hands-on experience as a Cortex practitioner in a Professional Services, MSSP, or Customer Engineering role, with deep domain knowledge of enterprise technologies and infrastructure.
•Deep expertise in XSIAM technical tracks: data onboarding (Broker VM, syslog/CEF, NGFW, GCP), XQL, parsing rules, correlation logic, playbook development, classifiers/mappers, and agentic AI features.
•Strong technical proficiency in Google Cloud Platform (Compute Engine, IAM, VPC, Cloud Storage) alongside PAN-OS NGFW, Active Directory, Windows Server, and Linux administration.
•Demonstrated experience writing automation scripts using Python, PowerShell, Bash, and Terraform for repeatable lab builds and environment resets.
•Proven background in technical instruction, training, or facilitation for senior engineering audiences, including live troubleshooting in a classroom setting.
•Excellent written communication skills for creating lab guides, maintaining issue logs, and delivering clear student evaluation reports.
•Based primarily in Santa Clara, CA or Plano, TX, with the ability to travel up to 50% for on-site bootcamp cohorts as needed.
Preferred Qualifications
•Active Cortex certifications (Cortex XSIAM Engineer/Analyst, Cortex XSOAR Engineer) or Palo Alto Networks certifications (PCNSE, PCNSA).
•Hands-on experience with lab orchestration platforms (e.g., Torque), lab image management, or observability pipelines like Cribl.
•Experience instructing engineers transitioning from competitive SIEM platforms (Splunk, Securonix) and mapping legacy concepts to XSIAM architecture.
•Background in writing technical assessments, rubrics, and grading criteria.
•Familiarity using generative AI tools for instructional content development and rapid troubleshooting.
