Security Workflow Specialist

We are seeking a skilled Security Automation Engineer to join our team. As a key member of our security operations team, you will be responsible for designing, developing, and maintaining automation playbooks to streamline security operations, reduce manual workloads, and enhance incident response efficiency.

• Design, develop, and maintain automation playbooks within SOAR platforms (Palo Alto XSIAM, QRadar SOAR, etc.) to automate repetitive tasks such as phishing response, malware triage, account lockouts, and threat containment.
• Integrate multiple security tools with SOAR for automated incident handling, ensuring seamless communication between teams and systems.
• Collaborate with SOC teams to translate manual workflows into automated playbooks, enhancing productivity and reducing the risk of human error.
• Create and maintain custom scripts to extend SOAR functionalities and integrate unsupported tools, driving innovation and efficiency in our security operations.
• Work closely with L1/L2 analysts to understand their challenges and design automation solutions that meet their needs, improving overall incident response efficiency.
• Build and optimize detection logic, correlation rules, and incident enrichment pipelines across SIEM/SOAR platforms, providing actionable insights to drive security decision-making.
• Maintain and optimize integrations with security platforms such as Proofpoint, Okta, SentinelOne, AWS Security Hub, Chronicle, and more, ensuring our security ecosystem remains robust and effective.
• Provide documentation, knowledge transfer, and training on automation workflows to SOC teams, promoting a culture of collaboration and continuous learning.
• Ensure automation aligns with security best practices, compliance, and operational efficiency, maintaining the highest standards of quality and excellence in our security operations.

• 4+ years of experience in Security Operations, Automation, or SOAR Engineering, with a strong foundation in security principles and technologies.
• Hands-on expertise with SOAR platforms such as Palo Alto XSIAM, QRadar SOAR, or similar, with experience in designing and implementing automation playbooks.
• Experience with SIEM solutions (QRadar, XSIAM, Splunk, Chronicle, etc.), with a solid understanding of log management, event correlation, and incident response.
• Strong scripting/programming skills in Python (mandatory), PowerShell, Bash, or JavaScript, with a proven ability to write efficient and effective code.
• Proven ability to design and deploy custom integrations and APIs for automation workflows, leveraging cloud-based services and SaaS security platforms.
• Familiarity with incident response processes and SOC operations, with a deep understanding of security domains such as phishing defense, malware analysis, threat intel, IAM, and vulnerability management.
• Experience working with cloud security platforms (AWS, Azure, GCP) and SaaS security integrations, with a solid understanding of cloud security architecture and best practices.
• Understanding of DevSecOps practices and CI/CD automation pipelines, with experience in automating testing, deployment, and monitoring of security applications.

• Palo Alto XSIAM or QRadar SOAR certification(s), demonstrating advanced knowledge and expertise in SOAR technologies.
• Exposure to containerization and orchestration tools (Docker, Kubernetes), with experience in designing and deploying containerized security applications.
• Experience in automating playbooks for phishing, malware, insider threat, and account takeover scenarios, with a proven track record of success in these areas.
• Knowledge of API development, REST, and JSON workflows, with experience in designing and implementing RESTful APIs for security applications.