Lead Response Technology and Automation Security Engineer

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build asustainableeconomy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Lead Response Technology and Automation Security Engineer

The Corporate Security Threat and Response Management product ownership team is looking for a Lead Level Security Engineer to help drive our Security Operations modernization strategy. The ideal candidate is passionate about the modern security tools, capabilities, and strategies. The RESPOND product team executes on the multi-year strategy and roadmap set by the RESPOND product owner to evolve and modernize Sec Ops incident investigation and response technology, capabilities, tools, and process.

Response product team members work closely with regional SOC teams to execute the RESPOND product strategy on the ground. This role is the connective tissue between product vision and operational reality: building, tuning, and operationalizing response automation, AI-augmented workflows, and analyst tooling that SOC and DFIR teams rely on every day. The RESPOND product team is hands‑on with SOAR development, agentic AI integration, notebook‑based investigation tooling, and continuous improvement of analyst workflows.

• Execute the RESPOND product roadmap in close partnership with SOC and Incident Response teams in the region.
• Design, build, test, and maintain SOAR playbooks used for incident triage and response scopes to collect and process digital evidence and artifacts at speed and scale.
• Build and operationalize AI-augmented response capabilities, including:
  • Agentic AI workflows integrated into triage, enrichment, and response
  • Prompt books and prompt libraries tuned for SOC and Incident Response use cases
  • Prompt-book/code notebook (Jupyter, etc) development for repeatable investigation, hunt, and DFIR workflows
  • LLM-driven enrichment and summarization integrated into case management
• Define strategic requirements and oversee management for connectors, apps, and integrations between SOAR, SIEM, EDR, identity, ticketing, threat intelligence, and AI/LLM platforms (including MCP servers where applicable) for build through our dedicated engineering partners.
• Build and maintain response tooling: scripts, live-response packages, enrichment services, and automation utilities deployable via EDR and SOAR.
• Embed with SOC and DFIR analysts to identify high-toil workflows and convert them into automated, AI-assisted, or fully autonomous playbooks with appropriate guardrails.
• Tune and optimize playbooks and AI-assisted workflows against measurable outcomes (MTTR, false-positive rate, analyst touch time, AI-assist accuracy).
• Contribute to the centralized response tooling, prompt book, and notebook libraries, ensuring code quality, documentation, version control, and reusability across regions.
• Support major incident response activities by deploying and operating response tooling and AI-assisted investigation workflows under pressure.
• Provide feedback into the product backlog and partner with the PO on requirements refinement.
• Document playbooks, prompt books, notebooks, and technical designs to enterprise standards.

• 5+ years in security operations, incident response, detection engineering, or security automation engineering
• Prior experience as a SOC analyst, Security Engineer, Digital Forensics Examiner, SOAR engineer,…