Cybersecurity Automation Lead

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

Lead Automation Engineer

We are seeking a Lead Automation Engineer (P5) to design, deliver, and scale automation that powers our cybersecurity platforms and operations. You will own the automation strategy and execution across SIEM, SOAR, endpoint, vulnerability, and cloud-security workflows—eliminating manual toil, standardizing deployments, and embedding reliability into the way we operate.

Location note: this is a remote role within 50km of Mississagua Ontario or St Laurent Quebec, or Calgary, AB, or Vancouver, BC

• Own the automation roadmap aligned to platform runbooks and quarterly objectives;
  prioritize high-value use cases that reduce manual effort and improve speed/quality.
• Design, implement, and maintain Python-based playbooks, micro-services, and scripts for enrichment, decisioning, remediation, and evidence collection.
• Deliver self-service capabilities (CLI/Chat Ops/UI) that enable platform teams and SOC/IR to perform standardized actions safely and repeatedly.
• Build robust API integrations between security tools and enterprise systems (e.G., SIEM/SOAR, endpoint, vulnerability scanners, ticketing/Service Now, CMDB, identity, cloud services).
• Implement CI/CD workflows (Git Hub Actions/Azure Dev Ops/Git Lab CI), environment promotion, secrets management, and rollback safety for automation code.
• Add observability to automation (structured logging, metrics, traces, alerts);
  track playbook success/failure, latency, and error budgets.
• Act as technical lead for automation initiatives;
  mentor engineers on Python, integration patterns, and CI/CD.
• Partner closely with SOC/IR, Platform Ops, Cloud/Infra, and GRC to align automation to operational, resilience, and compliance needs.

• Expert-level Python (designing maintainable packages/services, async patterns where useful, testing, packaging, dependency management).
• Practical experience building API integrations (REST/Graph
  
  QL), handling auth flows (OAuth2, JWT), and working with JSON/structured logs.
• Demonstrated Dev Ops capability: CI/CD pipelines, artifact versioning, release orchestration, and basic container familiarity (Docker).
• Hands-on with at least two security/platform domains (e.G., SIEM/SOAR, endpoint/EDR, vulnerability management, email/data security, cloud security).
• Strong communication skills and a track record of shipping reliable automation that measurably improves operations.

• Degree or equivalent and typically requires 10+ years of relevant experience. Less years required if has relevant Master’s or Doctorate qualifications.

• Experience with Terraform or Ansible for provisioning/configuration.
• Familiarity with event-driven patterns (webhooks, message queues) and serverless runtimes.
• Experience optimizing cost/throughput for data pipelines or security platform ingestion.
• Comfort with basic front-end for internal self-service tools (e.G., lightweight UIs, Chat Ops).

• Toil reduction and time-to-complete improvements for automated workflows.
• Playbook success rate, latency, and reduction in manual escalations.
• Coverage of automation across priority platforms (e.G., % alerts triaged/enriched automatically, % standard changes automated).
• Deployment reliability (pipeline success, rollback readiness, change-related incident reduction).
• Quality and completeness of audit-ready evidence produced automatically by automation jobs.

• Language: Python (primary)
• Dev Ops: Git Hub/Git Hub Actions or Azure Dev Ops;
  container builds;
  secrets…