Security Automation / Cortex XSOAR Engineer

Security Automation / Cortex XSOAR Engineer

• Develop, enhance, and maintain Palo Alto Cortex XSOAR playbooks and automated security workflows.
• Build automation to support Incident Response and Security Operations processes.
• Troubleshoot XSOAR integrations, playbooks, scripts, and automation failures.
• Develop and maintain integrations with security tools, SIEM platforms, and other enterprise technologies.
• Partner with Incident Response Analysts and SOC teams to identify opportunities for security automation.
• Analyze security events, incidents, and operational trends to identify areas for improvement.
• Define and implement new SOAR use cases, automation requirements, and response workflows.
• Use Python scripting/programming to develop and enhance security automation.
• Work with security teams to streamline incident response processes and improve operational efficiency.
• Support Splunk and other security monitoring technologies as part of incident investigation and automation workflows.
• Document playbooks, integrations, workflows, troubleshooting procedures, and operational processes.
• Participate in troubleshooting and resolution of security automation and integration issues.
• Help maintain and improve security operations procedures, standards, and best practices.

• High school diploma or equivalent.
• 5+ years of hands-on cybersecurity, security operations, incident response, or security automation experience.
• Strong hands-on experience developing and maintaining Palo Alto Cortex XSOAR playbooks.
• Experience building and supporting SOAR automation workflows.
• Strong Python scripting/programming skills.
• Solid understanding of Incident Response processes and security operations workflows.
• Hands-on experience with Splunk or another enterprise SIEM platform.
• Strong troubleshooting and security data analysis skills.
• Experience developing, maintaining, and troubleshooting automated security playbooks.
• Ability to work effectively with SOC, Incident Response, Cybersecurity, and Infrastructure teams.
• Strong written and verbal communication skills.

• CrowdStrike
• Proofpoint
• Tanium
• Microsoft Azure
• Digital Forensics
• Threat Intelligence
• SIEM technologies
• Network and security infrastructure
• Security orchestration and automation
• API integrations and security tool integrations
• Additional scripting/programming experience