Senior Security Automation Engineer

About the job

What You Will Do Design, build, and maintain production SOAR playbooks on Cortex XSOAR — alert enrichment, deduplication, auto-triage, and response orchestration that analysts actually trust. Develop custom integrations in Python against the tools a modern SOC runs on: EDR (CrowdStrike, SentinelOne), SIEM (Splunk, Microsoft Sentinel), ticketing and ITSM (ServiceNow), threat intelligence, and identity platforms. Lead SOAR content migrations and modernization — including moving playbook libraries from classic XSOAR to next-generation agentic automation platforms — without breaking the response workflows that depend on them. Treat automation content as code: version control, peer review, testing in staging, and controlled promotion to production. Engineer the judgment layer, not just the plumbing: human-in-the-loop checkpoints for destructive actions, confidence thresholds, and escalation paths when automation should stop and ask. Measure what you build: time-to-triage, false-positive burn-down, analyst hours returned — and defend the numbers. What We’re Looking For 4+ years in security operations or security engineering, with at least 2 years building SOAR automation in production (Cortex XSOAR strongly preferred; Splunk SOAR, Tines, or Swimlane considered). Strong Python for integration development — REST APIs, authentication flows, pagination, rate limits, and the unglamorous edges of vendor APIs. Real SOC context: you understand alerts, IOCs, MITRE ATT&CK, and the difference between an alert that needs a playbook and one that needs a tuning ticket. Judgment about what NOT to automate — you can articulate where a human must stay in the loop and why. Experience treating automation content as software: Git workflows, testing, staged rollouts. Flawless English communication — you will walk international security teams through what your playbooks do and prove they work.