Job Description

• Design, build, and maintain security automation across SIEM/SOAR platforms to streamline alert enrichment, correlation, incident response, and case management.
• Develop automation and integrations using Python, PowerShell, APIs, and cloud-native technologies with production-quality monitoring, documentation, and error handling.
• Collaborate with SOC analysts, detection engineers, and incident responders to automate repetitive tasks, improve detection quality, and reduce false positives.
• Design and implement AI-assisted and agentic security workflows for investigation, enrichment, summarization, and decision support while ensuring human oversight and governance.
• Partner with security, infrastructure, compliance, and platform teams to establish automation standards, perform code reviews, and mentor junior engineers.
• Continuously improve SOC operational efficiency by identifying opportunities to automate manual processes and enhance incident response capabilities.
• Evaluate and implement emerging AI and automation technologies to strengthen security operations.

• 6–9 years of cybersecurity engineering experience, including hands-on experience with security automation and SOC engineering.
• Strong software engineering mindset with the ability to build scalable, reliable, and maintainable automation solutions.
• Experience working collaboratively with cross-functional security and infrastructure teams.
• Excellent analytical and problem-solving skills with the ability to improve operational efficiency through automation.
• Strong communication, documentation, and mentoring abilities.
• Interest in leveraging AI technologies to modernize security operations while maintaining appropriate governance and security controls.

• 6–9 years of cybersecurity engineering experience, including 3–4 years in security automation, SIEM/SOAR development, or SOC engineering.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field preferred.
• Strong proficiency with Python, PowerShell, REST APIs, cloud automation, and integration development.
• Hands-on experience with enterprise SIEM/SOAR platforms, preferably Microsoft Sentinel.
• Experience with Microsoft Defender XDR, Azure Logic Apps, or similar Microsoft security technologies.
• Solid understanding of threat detection, logging pipelines, incident response workflows, alert tuning, and security operations metrics.
• Excellent documentation, communication, and collaboration skills.

• Experience with Tines for SOC automation and workflow orchestration.
• Experience building Agentic SOC solutions using AI/LLM technologies.
• Knowledge of Detection-as-Code, CI/CD pipelines, MITRE ATT&CK, ASIM, Sigma Rules, or observability platforms.
• Experience with AI/ML-assisted security tools, prompt engineering, and intelligent agents.
• Relevant certifications such as:
  • Microsoft Cybersecurity Architect
  • Microsoft Azure Security Engineer Associate
  • GIAC Security Automation Certification