Design, build, and maintain automation for alert enrichment, correlation, triage, incident response, and case handoffs across SIEM/SOAR platforms such as Microsoft Sentinel, Defender/XDR, Azure Logic Apps, Tines, ServiceNow, Log Analytics, and Confluence.
Develop integrations and tooling using Python, PowerShell, APIs, and cloud-native services, with production-quality error handling, monitoring, documentation, and reuse.
Collaborate with detection engineers, incident responders, and SOC analysts to identify automation opportunities, improve detection workflows, reduce false positives, and streamline analyst operations.
Design AI-assisted and agentic workflows for enrichment, investigation, summarization, and decision support, ensuring human-in-the-loop approvals, auditability, and measurable quality controls.
Partner with security, infrastructure, platform, compliance, and risk teams; participate in code/design reviews; mentor others; and help establish reusable automation standards and patterns.
Requirements
- 6-9 years of cybersecurity engineering experience, including 3-4 years focused on security automation, SOC engineering, SIEM/SOAR development, or similar work.
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field *(preferred)*
- Strong proficiency with Python, PowerShell, APIs, cloud automation, and production-grade integration patterns.
- Hands-on experience with enterprise SIEM/SOAR platforms, Microsoft Sentinel preferred, and working knowledge of Microsoft Defender/XDR, Azure Logic Apps, or similar technologies.
- Solid understanding of threat detection, logging pipelines, alert tuning, incident response workflows, and operational metrics.
- Excellent problem-solving, documentation, communication, and collaboration skills, with a track record of delivering reliable automation in production.
- Preferred Qualifications:
- Experience with Tines for SOC automation and agentic workflow orchestration.
- Experience building an Agentic SOC using LLM/AI agents for enrichment, investigation, triage, response, and feedback-driven evaluation.
- Experience with detection-as-code, CI/CD, MITRE ATT&CK, ASIM schemas, Sigma rules, behavioral detections, or observability pipelines.
- Hands-on experience with LLMs, intelligent agents, AI/ML-assisted security tooling, prompt design, or agent evaluation.
- Relevant certifications such as Microsoft Cybersecurity Architect, GIAC Security Automation, or Azure Security Engineer Associate.
Core Competencies
Demonstrates expertise in cybersecurity engineering with a strong focus on security automation and SIEM/SOAR development. Proficient in Python, PowerShell, and cloud automation, with a solid understanding of threat detection and incident response workflows.
Highest-signal resume keywords
- Cybersecurity Engineering Experience
- Security Automation Expertise
- Python Proficiency
- Microsoft Sentinel Experience
- Incident Response Workflows
ATS Optimization KeywordsHard Skills
- Python
- PowerShell
- APIs
- Cloud Automation
- SIEM/SOAR Development
- Incident Response
- Threat Detection
- Alert Tuning
- Production-Grade Integration Patterns
- Detection-As-Code
Soft Skills
- Problem-Solving
- Documentation
- Communication
- Collaboration
Certifications & Qualifications
- Microsoft Cybersecurity Architect
- GIAC Security Automation
- Azure Security Engineer Associate
Industry Keywords
- SOC Engineering
- Automation Standards
- LLM/AI Agents
- MITRE ATT&CK
- Sigma Rules
Tools & Technologies
- Microsoft Sentinel
- Defender/XDR
- Azure Logic Apps
- Tines
- ServiceNow
- Log Analytics
- Confluence