Senior Security Automation Engineer

Responsibilities of the Senior Security Automation Engineer:

• Design, develop, and optimize security automation and orchestration workflows across enterprise security environments
• Build and maintain SOAR playbooks supporting alert enrichment, investigation, incident response, escalation, and automated remediation
• Develop Python-based automation and custom integrations using REST APIs and other security platform interfaces
• Integrate SOAR platforms with SIEM, EDR, ITSM, threat intelligence, identity, and other cybersecurity technologies
• Develop reusable automation frameworks and standardized workflows to reduce manual analyst effort
• Troubleshoot and enhance existing automation, integrations, playbooks, and security workflows
• Collaborate with cybersecurity, SOC, engineering, and infrastructure teams to identify automation and process improvement opportunities
• Support implementation, configuration, testing, and optimization of security automation platforms
• Develop technical documentation, runbooks, integration guides, and operational procedures
• Provide technical guidance and knowledge transfer to security operations teams
• Ensure automation workflows are reliable, auditable, scalable, and aligned with security requirements

• 5+ years of experience in cybersecurity, security engineering, security operations, or a related technical discipline
• Hands‑on experience with SOAR platforms such as Splunk SOAR/Phantom, Cortex XSOAR, or Demisto
• Strong Python development and scripting experience
• Experience developing REST API integrations and connecting cybersecurity platforms
• Experience designing security automation workflows, orchestration processes, and SOAR playbooks
• Experience with SIEM platforms, particularly Splunk and/or Splunk Enterprise Security
• Understanding of SOC operations, incident response, alert triage, enrichment, and automated remediation
• Experience integrating EDR, threat intelligence, ITSM, identity, and endpoint security platforms
• Strong troubleshooting, analytical, and problem-solving skills
• Ability to work independently and collaborate effectively with technical and security teams
• Excellent written and verbal communication skills

• Experience with Splunk Enterprise Security, Splunk Cloud, or Splunk SOAR
• Experience with Cortex XSOAR/Demisto
• Experience with Service Now integrations
• Experience with Cribl, Crowd Strike, Tanium, or other enterprise security platforms
• Experience with AWS, Azure, Docker, Kubernetes, Git, Jenkins, or CI/CD pipelines
• Experience working in an MSSP, MDR, cybersecurity consulting, or professional services environment
• Experience with detection engineering, MITRE ATT&CK, threat intelligence, or UEBA
• Splunk, GIAC/SANS, CISSP, or related cybersecurity certifications

• Salary: $130,000 - $145,000 + Bonus Incentives
• Comprehensive benefits package including Medical, Dental, Vision, 401(k), PTO, and Paid Holidays

#LI-MM1 #LI-REMOTE

Splunk SOAR, Splunk Phantom, Cortex XSOAR, Demisto, SOAR, Security Automation, Security Orchestration, Python, REST API, API Integration, SIEM, Splunk Enterprise Security, Splunk ES, Playbooks, Incident Response, SOC, EDR, Service Now, Threat Intelligence, Detection Engineering, MSSP, MDR, Cybersecurity, Automation, Orchestration