ZipRecruiter

Log In

1

Xsoar Engineer Jobs in Florida (NOW HIRING)

Venatore Llc

Splunk SOAR Engineer

Tampa, FL · On-site

The Splunk SOAR Engineer will lead the full lifecycle of platform architecture, integration ... Experience with other SOAR platforms (e.g., Palo Alto Cortex XSOAR, IBM Resilient). * Experience ...

LGL Technologies

SOC Analyst

Saint Petersburg, FL · On-site

SOAR: Palo Alto XSOAR, Splunk SOAR * Forensics: FTK Imager, Autopsy, Wireshark, Procmon ... Product Engineering, and IT Services. We provide comprehensive solutions and strategic advisory ...

All JobsXsoar Engineer JobsXsoar Engineer Jobs in Florida

Xsoar Engineer information

What are the key skills and qualifications needed to thrive as an XSOAR Engineer, and why are they important?

To thrive as an XSOAR Engineer, you need expertise in cybersecurity, scripting (such as Python), and incident response, usually supported by a degree in computer science or a related field. Familiarity with Palo Alto Cortex XSOAR, SIEM platforms, and relevant certifications like Palo Alto Networks Certified Security Automation Engineer (PCSAE) is essential. Strong problem-solving skills, attention to detail, and effective communication set top performers apart in this role. These skills and qualifications are vital for efficiently automating security operations and improving an organization's incident response capabilities.

What is an XSOAR Engineer?

An XSOAR Engineer is a cybersecurity professional who specializes in deploying, configuring, and maintaining Palo Alto Networks Cortex XSOAR (Extended Security Orchestration, Automation, and Response) platforms. Their main responsibilities include automating security operations, integrating threat intelligence, and developing playbooks to streamline incident response. XSOAR Engineers work closely with security teams to improve efficiency and reduce response times to cyber threats. They require strong knowledge of security operations, scripting, and integrating various security tools and APIs. This role is crucial in modern security operations centers (SOCs) to enhance automation and coordination of security processes.

What are some common challenges XSOAR Engineers face when integrating new security tools into an existing SOAR platform?

XSOAR Engineers often encounter challenges when integrating new security tools due to differences in APIs, data formats, and authentication methods. Ensuring seamless communication between platforms requires strong troubleshooting skills and an in-depth understanding of both the SOAR platform and the third-party tool. Additionally, engineers must carefully map data fields and develop custom scripts when out-of-the-box integrations are not available. Collaboration with security analysts and vendors is essential to address compatibility issues and maintain effective automation workflows.

What is the difference between Xsoar Engineer vs Cortex XSOAR Specialist?

AspectXsoar EngineerCortex XSOAR Specialist
CertificationsRelevant security and cloud certifications, such as Palo Alto Networks certificationsSame certifications, often including Palo Alto Networks certifications
Work EnvironmentSecurity teams, cybersecurity firms, IT departmentsSecurity operations centers, cybersecurity consulting firms
Industry UsageUsed across industries for security automation and orchestrationPrimarily in cybersecurity and threat management sectors
Job FocusDesign, develop, and maintain Xsoar integrations and automationImplement, optimize, and manage Cortex XSOAR platforms and playbooks

Both roles focus on security automation with Cortex XSOAR, but Xsoar Engineers typically develop and maintain integrations, while Cortex XSOAR Specialists focus on platform deployment and management. The roles often overlap, especially in organizations using Cortex XSOAR for security operations.

What are popular job titles related to Xsoar Engineer jobs in Florida? For Xsoar Engineer jobs in Florida, the most frequently searched job titles are:
What job categories do people searching Xsoar Engineer jobs in Florida look for? The top searched job categories for Xsoar Engineer jobs in Florida are:
What cities in Florida are hiring for Xsoar Engineer jobs? Cities in Florida with the most Xsoar Engineer job openings:
Xsoar Engineer jobs near you
Splunk SOAR Engineer

Splunk SOAR Engineer

Venatore Llc

Tampa, FL • On-site

Full-time

Medical, Dental, Vision, Retirement, PTO

Posted 25 days ago

Job description

About Us
Venatore is a woman-owned small business headquartered in Tampa, Florida, providing mission-driven technology and professional services to federal defense and civilian agencies. We deliver expertise in information technology, engineering, logistics, and program support to help our clients achieve operational excellence and mission success.

About the Job
Venatore is seeking a Splunk SOAR Engineer to support U.S. Central Command (USCENTCOM) operations by designing, implementing, and optimizing enterprise-level Security Orchestration, Automation, and Response (SOAR) capabilities. This role is responsible for transforming manual incident response processes into scalable, automated workflows that accelerate threat detection, containment, and remediation. The Splunk SOAR Engineer will lead the full lifecycle of platform architecture, integration, content development, and performance optimization while collaborating closely with SOC analysts, threat hunters, and incident response teams. An active TS/SCI clearance is required.

Responsibilities

Platform Architecture & Engineering

  • Design, deploy, document, and maintain distributed Splunk SOAR (Phantom) platform architecture to ensure high availability, scalability, and performance.

  • Support system upgrades, patching, and performance tuning across the SOAR infrastructure.

  • Provide advanced troubleshooting and resolution of platform issues and playbook execution errors.

  • Adhere to security best practices and compliance requirements within the operational environment.

Playbook Development & Automation

  • Develop, customize, and maintain complex SOAR playbooks using Python and the Phantom Playbook Editor for automated enrichment, triage, containment, and remediation of security incidents (e.g., phishing, malware, unauthorized access).

  • Translate manual security procedures into robust, automated workflows aligned with SecOps best practices.

  • Establish and track automation metrics, including utilization rates, automation coverage, and Mean Time to Respond (MTTR) improvements.

Integration & Interoperability

  • Integrate Splunk SOAR with Splunk Enterprise Security (ES) and other core security technologies, including EDR/XDR platforms, firewalls, vulnerability scanners, threat intelligence platforms, and ticketing systems.

  • Develop custom apps and integrations to connect proprietary or unsupported security tools using RESTful APIs and custom connectors.

  • Manage and optimize data flow between Splunk ES and Splunk SOAR to ensure effective event-triggered automation actions.

Collaboration & Documentation

  • Partner with SOC analysts, threat hunters, and incident response teams to gather requirements and document workflows.

  • Develop and maintain detailed technical documentation for platform configurations, integrations, and automation content.

  • Provide training and mentorship to SOC staff on SOAR usage, content development, and automation best practices.

  • Evaluate and integrate emerging security technologies and threat intelligence feeds into the automation ecosystem.

Required Qualifications

  • Active TS/SCI security clearance.

  • U.S. citizenship.

  • Applicable DoD 8140 or DoD 8570 certification.

  • 8+ years of related experience in security engineering or security operations.

  • Hands-on expertise with Splunk SOAR (Phantom) administration, configuration, and maintenance in a distributed enterprise environment.

  • Advanced proficiency in Python scripting for playbook development, custom apps, and integrations.

  • Proven experience integrating SOAR platforms with Splunk Enterprise Security (ES), SIEMs, EDR/XDR tools, and other security technologies.

  • Strong understanding of security operations principles, incident response lifecycles, and threat detection methodologies.

  • Experience working with RESTful APIs and developing tool connectors.

  • Proficiency in data manipulation, log parsing, and understanding of the Common Information Model (CIM) in a security context.

  • Strong verbal and written communication skills with the ability to convey complex automation concepts to technical and non-technical audiences.

Preferred Qualifications

  • Familiarity with cloud security logging, containerization (Docker/Kubernetes), and CI/CD pipelines for playbook deployment.

  • Knowledge of the MITRE ATT&CK framework and its application in automated detection and response use cases.

  • Experience using Git or other version control systems for SOAR content management.

  • Familiarity with network protocols, Windows and Linux operating systems, and enterprise security architecture components.

  • Splunk Enterprise Security Certified Admin or Architect certification.

  • Splunk SOAR (Phantom) Certified Content Developer or Administrator certification.

  • Experience with other SOAR platforms (e.g., Palo Alto Cortex XSOAR, IBM Resilient).

  • Experience supporting USCENTCOM or multi-domain defense security operations environments.

  • ITIL 4 Foundation certification.

Benefits
Venatore offers a competitive benefits package designed to support the well-being of our employees, including:

  • Paid Time Off (PTO)

  • 10 Federal Holidays

  • 401(k) with company matching

  • Medical, dental, and vision insurance

  • Paid parental leave

  • Paid military leave

Venatore is an equal opportunity employer and considers qualified applicants without regard to disability or protected veteran status.