Design, build, and maintain security automation across SIEM/SOAR platforms to streamline alert enrichment, correlation, incident response, and case management.
Develop automation and integrations using Python, PowerShell, APIs, and cloud-native technologies with production-quality monitoring, documentation, and error handling.
Collaborate with SOC analysts, detection engineers, and incident responders to automate repetitive tasks, improve detection quality, and reduce false positives.
Design and implement AI-assisted and agentic security workflows for investigation, enrichment, summarization, and decision support while ensuring human oversight and governance.
Partner with security, infrastructure, compliance, and platform teams to establish automation standards, perform code reviews, and mentor junior engineers.
Continuously improve SOC operational efficiency by identifying opportunities to automate manual processes and enhance incident response capabilities.
Evaluate and implement emerging AI and automation technologies to strengthen security operations.
The Right Candidate Will Possess
6–9 years of cybersecurity engineering experience, including hands‑on experience with security automation and SOC engineering.
Strong software engineering mindset with the ability to build scalable, reliable, and maintainable automation solutions.
Experience working collaboratively with cross‑functional security and infrastructure teams.
Excellent analytical and problem‑solving skills with the ability to improve operational efficiency through automation.
Strong communication, documentation, and mentoring abilities.
Interest in leveraging AI technologies to modernize security operations while maintaining appropriate governance and security controls.
Required Qualifications & Skills
6–9 years of cybersecurity engineering experience, including 3–4 years in security automation, SIEM/SOAR development, or SOC engineering.
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field preferred.
Strong proficiency with Python, PowerShell, REST APIs, cloud automation, and integration development.
Hands‑on experience with enterprise SIEM/SOAR platforms, preferably Microsoft Sentinel.
Experience with Microsoft Defender XDR, Azure Logic Apps, or similar Microsoft security technologies.
Solid understanding of threat detection, logging pipelines, incident response workflows, alert tuning, and security operations metrics.
Excellent documentation, communication, and collaboration skills.
Preferred Qualifications
Experience with Tines for SOC automation and workflow orchestration.
Experience building Agentic SOC solutions using AI/LLM technologies.
Knowledge of Detection-as-Code, CI/CD pipelines, MITRE ATT&CK, ASIM, Sigma Rules, or observability platforms.
Experience with AI/ML-assisted security tools, prompt engineering, and intelligent agents.