Senior Security Automation Engineer

About the role

Support enterprise cybersecurity operations through the design, development, and optimization of security orchestration and automation solutions.

Responsibilities

• Design, develop, and optimize security automation and orchestration workflows across enterprise security environments
• Build and maintain SOAR playbooks supporting alert enrichment, investigation, incident response, escalation, and automated remediation
• Develop Python-based automation and custom integrations using REST APIs and other security platform interfaces
• Integrate SOAR platforms with SIEM, EDR, ITSM, threat intelligence, identity, and other cybersecurity technologies
• Develop reusable automation frameworks and standardized workflows to reduce manual analyst effort
• Troubleshoot and enhance existing automation, integrations, playbooks, and security workflows
• Collaborate with cybersecurity, SOC, engineering, and infrastructure teams to identify automation and process improvement opportunities
• Support implementation, configuration, testing, and optimization of security automation platforms
• Develop technical documentation, runbooks, integration guides, and operational procedures
• Provide technical guidance and knowledge transfer to security operations teams
• Ensure automation workflows are reliable, auditable, scalable, and aligned with security requirements

Requirements

• 5+ years of experience in cybersecurity, security engineering, security operations, or a related technical discipline
• Hands-on experience with SOAR platforms such as Splunk SOAR/Phantom, Cortex XSOAR, or Demisto
• Strong Python development and scripting experience
• Experience developing REST API integrations and connecting cybersecurity platforms
• Experience designing security automation workflows, orchestration processes, and SOAR playbooks
• Experience with SIEM platforms, particularly Splunk and/or Splunk Enterprise Security
• Understanding of SOC operations, incident response, alert triage, enrichment, and automated remediation
• Experience integrating EDR, threat intelligence, ITSM, identity, and endpoint security platforms
• Strong troubleshooting, analytical, and problem-solving skills
• Ability to work independently and collaborate effectively with technical and security teams
• Excellent written and verbal communication skills

Preferred Qualifications

• Experience with Splunk Enterprise Security, Splunk Cloud, or Splunk SOAR
• Experience with Cortex XSOAR/Demisto
• Experience with ServiceNow integrations
• Experience with Cribl, CrowdStrike, Tanium, or other enterprise security platforms
• Experience with AWS, Azure, Docker, Kubernetes, Git, Jenkins, or CI/CD pipelines
• Experience working in an MSSP, MDR, cybersecurity consulting, or professional services environment
• Experience with detection engineering, MITRE ATT&CK, threat intelligence, or UEBA
• Splunk, GIAC/SANS, CISSP, or related cybersecurity certifications

Pay

Salary: $130,000 - $145,000 + Bonus Incentives

Benefits

• Medical, Dental, Vision
• 401(k)
• PTO
• Paid Holidays