Job Description

Chubb Global Information Security is looking for a hands-on Security Automation Engineer to build, own, and maintain the security automation platform that powers day-to-day detection-to-response workflows for our SOC. This role is responsible for our SOAR platform, including Python-based automation, custom API integrations, and the case and incident management tooling analysts rely on every day. The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation, and is comfortable using modern AI tooling (Claude/Claude Code or similar) as part of daily engineering work to build and extend that automation faster.

Responsibilities:

• Design, build, and maintain SOAR playbooks and Python-based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Own and evolve our case and incident management application, including analyst-facing workflows and JavaScript-based UI widgets
• Build and maintain custom API integrations, including non-standard auth schemes (e.g., HMAC request signing), pagination, and high-volume or rate-limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end-to-end, from alert ingestion through case closure
• Build and extend AI-assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows

• Evaluate new security tools and data sources for integration feasibility and automation potential

• 3-5 years of IT/security engineering experience, including hands-on scripting or automation work
• Strong Python scripting ability, with experience building and debugging integrations against third-party REST APIs
• Working knowledge of JavaScript for building or maintaining web-based UI components
• Experience integrating disparate security tools (SIEM, EDR, ticketing/ITSM, email security, threat intel, or similar) via API
• Comfortable using AI coding/analysis tools (Claude Code or similar) to build and maintain automation
• Strong troubleshooting and debugging skills across multi-system workflows
• Excellent communication skills - able to translate analyst and IR pain points into automated solutions
• Solid documentation habits for technical automation logic and integration configurations
• Strong time management and organizational skills

Preferred Qualifications:

• Hands-on experience with a SOAR platform (Splunk SOAR/Phantom, Palo Alto XSOAR, Tines, or similar)
• Experience with case or incident management application design and configuration
• Exposure to agentic AI frameworks (e.g., LangGraph) for building AI-assisted security workflows
• Familiarity with Microsoft Sentinel/KQL or another SIEM

• Security certifications such as Security+, GCIH, or similar

• Experience with enterprise security/infrastructure APIs (e.g., Microsoft Graph, Akamai EdgeGrid)