Senior Automation, Cybersecurity Engineer

Design, build, and maintain automation for alert enrichment, correlation, triage, incident response, and case handoffs across SIEM/SOAR platforms such as Microsoft Sentinel, Defender/XDR, Azure Logic Apps, Tines, Service Now, Log Analytics, and Confluence.
Develop integrations and tooling using Python, Power Shell, APIs, and cloud-native services, with production-quality error handling, monitoring, documentation, and reuse.
Collaborate with detection engineers, incident responders, and SOC analysts to identify automation opportunities, improve detection workflows, reduce false positives, and streamline analyst operations.
Design AI-assisted and agentic workflows for enrichment, investigation, summarization, and decision support, ensuring human-in-the-loop approvals, auditability, and measurable quality controls.
Partner with security, infrastructure, platform, compliance, and risk teams; participate in code/design reviews; mentor others; and help establish reusable automation standards and patterns.

• 6-9 years of cybersecurity engineering experience, including 3-4 years focused on security automation, SOC engineering, SIEM/SOAR development, or similar work.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field *(preferred)*
• Strong proficiency with Python, Power Shell, APIs, cloud automation, and production-grade integration patterns.
• Hands-on experience with enterprise SIEM/SOAR platforms, Microsoft Sentinel preferred, and working knowledge of Microsoft Defender/XDR, Azure Logic Apps, or similar technologies.
• Solid understanding of threat detection, logging pipelines, alert tuning, incident response workflows, and operational metrics.
• Excellent problem-solving, documentation, communication, and collaboration skills, with a track record of delivering reliable automation in production.
• Preferred Qualifications:
• Experience with Tines for SOC automation and agentic workflow orchestration.
• Experience building an Agentic SOC using LLM/AI agents for enrichment, investigation, triage, response, and feedback-driven evaluation.
• Experience with detection-as-code, CI/CD, MITRE ATT&CK, ASIM schemas, Sigma rules, behavioral detections, or observability pipelines.
• Hands-on experience with LLMs, intelligent agents, AI/ML-assisted security tooling, prompt design, or agent evaluation.
• Relevant certifications such as Microsoft Cybersecurity Architect, GIAC Security Automation, or Azure Security Engineer Associate.

Demonstrates expertise in cybersecurity engineering with a strong focus on security automation and SIEM/SOAR development. Proficient in Python, Power Shell, and cloud automation, with a solid understanding of threat detection and incident response workflows.

• Cybersecurity Engineering Experience
• Security Automation Expertise
• Python Proficiency
• Microsoft Sentinel Experience
• Incident Response Workflows

• Python
• Power Shell
• APIs
• Cloud Automation
• SIEM/SOAR Development
• Incident Response
• Threat Detection
• Alert Tuning
• Production-Grade Integration Patterns
• Detection-As-Code

• Problem-Solving
• Documentation
• Communication
• Collaboration

• Microsoft Cybersecurity Architect
• GIAC Security Automation
• Azure Security Engineer Associate

• SOC Engineering
• Automation Standards
• LLM/AI Agents
• MITRE ATT&CK
• Sigma Rules

• Microsoft Sentinel
• Defender/XDR
• Azure Logic Apps
• Tines
• Service Now
• Log Analytics
• Confluence