Description

Design and build SOAR playbooks to automate security operations tasks across Microsoft Sentinel, EDR/XDR, and ServiceNow ecosystems.

This role is hybrid.

Responsibilities

• Design and build playbooks in Microsoft Sentinel for enrichment, triage, notification, containment, and post-incident actions.
• Integrate security ecosystems including EDR/XDR, firewalls, threat intelligence feeds, cloud platforms, and identity stores.
• Implement error handling, idempotency, health checks, and observability within automation workflows.
• Improve the detection-to-response flow by enriching alerts and streamlining handoffs between SIEM, SOAR, and ServiceNow.
• Manage governance by implementing version control, code reviews, and CI/CD pipelines.

Required Skills

• 4+ years working with SOAR, preferably Microsoft Sentinel or Logic Apps.
• 4+ years hands-on experience with ServiceNow automations.
• Strong SOA engineering skills: event parsing, enrichment patterns, containment actions, webhooks, and API integrations.
• Proficiency in scripting using Python and/or PowerShell.
• Working knowledge of JSON, REST, and event-driven patterns.
• Familiarity with Git-based SDLC and basic CI/CD practices.
• Experience with automation platforms, including Azure Logic Apps, Functions, or Automation Accounts.
• Understanding of security concepts like MITRE ATT&CK and incident lifecycles.

Preferred Skills

• Bachelor's degree in Computer Science or related field.
• Experience with Terraform and Jira for infrastructure and workflow management.

Key Skills

Education

Bachelor's degree