Customer Delivery Architect | 10+ years, SOC transformation
Cisco · Posted Oct 22
Networking, cloud, cybersecurity, and enterprise IT infrastructure services
Get a personal compatibility score
Add a resume for personal matches
About the role
Cisco Customer Experience (CX) Security Services is a global team of security practitioners, architects, and advisors helping enterprise and service provider customers achieve operational cyber resilience. The SOC Transformation & Advanced Analytics practice designs and delivers next-generation SOC architectures, SIEM modernization, behavioral analytics, and end-to-end security automation. This role is a hands-on security consulting architect who leads enterprise SOC modernization journeys built on Splunk Cloud, Splunk ES, Splunk SOAR, UEBA, Cribl Stream, and MinIO object storage, while advising customer CISOs and leading engineering execution pods.
What you will do
- Target SOC Architecture & Transformation Strategy: Lead the architectural design, Target Operating Model (TOM), and delivery strategy for multi-tier enterprise SOCs, SIEM modernizations, and security automation frameworks aligned with MITRE ATT&CK and Cisco Validated Designs.
- Splunk Cloud & Enterprise Security (ES) Mastery: Architect enterprise-scale Splunk Cloud deployments; design Risk-Based Alerting (RBA) frameworks, Data Model Acceleration (DMA) strategies, optimized | tstats search pipelines, Asset & Identity (A&I) contextual enrichment, and ESCU detection updates to eliminate alert fatigue.
- Modern Telemetry Ingestion & Storage Architecture: Architect high-throughput, resilient security data collection pipelines leveraging Cribl Stream for edge transformation, filtering, and routing, combined with MinIO / S3-compatible object storage for high-performance SmartStore tiering and compliance data archiving.
- Security Automation & SOAR Engineering: Define incident triage and response workflows, designing modular, production-grade Python playbooks in Splunk SOAR for automated threat enrichment (Talos, VirusTotal), endpoint containment (EDR isolation), firewall mitigation, and bidirectional ITSM (ServiceNow) synchronization.
- Technical Pod Leadership & Governance: Provide technical direction, architectural governance, and mentorship to specialized engineering execution pods (Data Ingestion/GDI, Detection Engineering, UEBA, SOAR); serve as the hands-on escalation authority for complex SPL optimization, CIM normalization, and API integrations.
Skills used in this role
What the employer is looking for
- 10+ years of technical cybersecurity engineering and architecture experience designing and deploying enterprise Security Operations Center (SOC) environments and SIEM/SOAR platforms.
- 5+ years of dedicated, hands-on architecture and engineering experience with Splunk Enterprise, Splunk Cloud, and Splunk Enterprise Security (ES), including correlation search engineering, Data Model Acceleration, and Risk-Based Alerting (RBA).
- 3+ years of hands-on experience in security telemetry pipeline engineering, including log routing and normalization with Cribl Stream, data parsing (props.conf / transforms.conf), and object storage/SmartStore tiering with MinIO or S3-compatible cloud storage.
- 3+ years of security orchestration and automation experience designing and building automated response playbooks using Splunk SOAR (Phantom), REST APIs, and Python
- Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical industry engineering experience.
Preferred qualifications
- Splunk & Pipeline Certifications: Splunk Enterprise Certified Architect, Splunk Enterprise Security Certified Admin, Splunk SOAR Certified Automation Developer, or Cribl Certified Observability Engineer (CCOE).
- Industry Security Credentials: CISSP, CCIE Security, CISM, or GIAC certifications (GCIH, GCIA, GDSA, GMON).
- Advanced Behavioral Analytics & Threat Modeling: Practical experience deploying Splunk UEBA, implementing machine learning models for anomaly detection, and conducting atomic detection testing against the MITRE ATT&CK matrix.
- Executive Advisory & Technical Consulting: Exceptional C-suite consulting, presentation, and technical leadership skills with a proven track record of advising CISOs, leading technical workshops, and driving organizational change.
- Hybrid Cloud & Multi-Vendor Ecosystem Integration: Deep knowledge of multi-cloud security logging, Next-Gen Firewalls (Palo Alto, Cisco Secure Firewall), EDR platforms (CrowdStrike, Microsoft Defender), and Cisco Security Cloud integrations.
Benefits and support
- Compensation and benefits are detailed in the job posting
About Cisco
Cisco Systems, Inc. is a worldwide leader in IT, networking, and cybersecurity solutions that transform how people connect, communicate, and collaborate. The company specializes in routing, switching, data center infrastructure, and software-defined networking designed for enterprises of all sizes. Today, Cisco drives major advancements in AI infrastructure, observability, and secure hybrid work platforms.
- Industry
- Networking
- Company size
- 90000+ employees
- Founded
- 1984
- Location
- San Jose, California, USA
- Funding stage
- Public Company
Leadership
Chair and Chief Executive Officer
President and Chief Product Officer
Executive Vice President and Chief Financial Officer
Executive Vice President and Chief People, Policy & Purpose Officer
Executive Vice President and Chief Customer Experience Officer
Recent coverage
Cisco Newsroom
Cisco Advances Scalability and Openness at OCP 20262026-10-20
PR Newswire
NVIDIA and Cisco Introduce New Pluggable Optics Form Factor to Scale AI Factories2026-10-12
Cisco Newsroom
Cisco Appoints Girish Rishi to its Board of Directors2026-10-12
Cisco Newsroom
WebexOne 2026: Cisco Introduces Agentic Collaboration Innovations2026-10-07