Xsoar Engineer Jobs in Toronto, ON (NOW HIRING)

What is the opportunity

We are looking for a Senior Software Developer to join our Security Automation team, responsible for engineering and scaling our SOAR platform. This is a development-first role - you will design, build, test, and deploy automation software that powers security operations across the enterprise. The ideal candidate writes production-quality Python, thinks in APIs and data contracts, and treats infrastructure-as-code as a default.

What will you do?

• Automation Software Development- Design and develop automation playbooks, scripts, and orchestration workflows in Python following software engineering best practices (modularity, error handling, logging, testability)

• Write clean, maintainable, and well-tested code that adheres to team coding standards and passes peer review

• Build reusable automation libraries and frameworks that reduce duplication and accelerate future development

• Integration & API Development- Develop custom integrations in Python connecting XSOAR to internal platforms, REST/GraphQL APIs, databases, and third-party security tools

• Implement robust API client patterns - authentication, retry logic, pagination, rate-limiting, and schema validation

• Own the data contracts between systems; design normalized data models for cross-platform incident and telemetry flows

• CI/CD & DevOps Practices- Build and maintain CI/CD pipelines for XSOAR content delivery (linting, unit testing, integration testing, automated deployment)

• Manage version control workflows in Git - branching strategies, pull request reviews, and release management for automation content

• Containerize integrations using Docker; manage development and staging environments for pre-production validation

• Platform Engineering & Reliability-Administer the XSOAR platform - upgrades, performance tuning, high-availability configuration, and monitoring

• Implement observability: structured logging, health checks, alerting on playbook failures, and execution metrics

• Design scalable patterns for incident classification, enrichment pipelines, and response orchestration

• Participate in Agile ceremonies (sprint planning, standups, retrospectives); estimate and deliver work within committed timelines

• Partner with SOC analysts and detection engineers to gather requirements and validate automation outcomes

• Produce technical documentation for integrations, runbooks for operational handoff, and knowledge transfer for the broader team

What do you need to succeed?

Must have:

• 5+ years of professional software development experience in Python

• Strong understanding of REST API design and consumption (authentication patterns, HTTP methods, status codes, payload serialization)

• Experience with Git workflows, code review practices, and CI/CD tooling (Jenkins, GitHub Actions, GitLab CI, or equivalent)

• Familiarity with testing frameworks (pytest, unittest) and writing unit/integration tests as part of the development lifecycle

• Working knowledge of Docker, Linux, and command-line tooling

• Experience with data formats and protocols: JSON, YAML, XML, webhooks, message queues
  

Nice to have:

• Prior experience with Cortex XSOAR (Demisto), Splunk SOAR, or similar orchestration platforms

• Familiarity with security concepts: incident response workflows, MITRE ATT&CK, threat intelligence, vulnerability management

• Experience with demisto-sdk or XSOAR content development framework

• Experience with big data technologies - data lakes, distributed processing frameworks (Spark, Hadoop), or large-scale data pipelines (Kafka, Airflow) for ingesting and correlating high-volume security telemetry

• Exposure to AI/ML concepts - working with LLMs, building AI-assisted workflows, prompt engineering, or integrating AI models into automation pipelines for tasks such as alert triage, anomaly detection, or natural language-driven investigation

• Exposure to databases (SQL/NoSQL) and data pipeline tools

• Background in building integrations with enterprise tools (ServiceNow, Jira, SIEM platforms, identity providers)

What's in it for you?
We thrive on the challenge to be our best, progressive thinking to keep growing, and working together to deliver trusted advice to help our clients thrive and communities prosper. We care about each other, reaching our potential, making a difference to our communities, and achieving success that is mutual.

• A comprehensive Total Rewards Program including bonuses and flexible benefits, competitive compensation, commissions, and stock where applicable

• Leaders who support your development through coaching and managing opportunities

• Support from a dynamic, collaborative, progressive, and high performing team, as well as world-class tools and training

• Ability to make a difference and lasting impact

• Work in a dynamic, collaborative, progressive, and high-performing team

• A world-class training program in financial services

• Opportunities to do challenging work

#LI-POST
#TECHPJ

Job Skills

Additional Job Details

Note: Applications will be accepted until 11:59 PM on the day prior to the application deadline date above

Our Employment Opportunities

At RBC, we are guided by living shared values of Client First, Integrity, Collaboration, Respect and Excellence and winning together as One RBC. We believe an inclusive workplace that has diverse perspectives is core to our continued growth as one of the largest and most successful banks in the world. Maintaining a workplace where our employees feel supported to perform at their best, effectively collaborate, drive innovation, and grow professionally helps to bring our Purpose to life and create value for our clients and communities. RBC strives to deliver this through policies and programs intended to foster a workplace based on respect, belonging and opportunity for all.

RBC is presently inviting candidates to apply for this existing vacancy. Applying to this posting allows you to express your interest in this current career opportunity at RBC. Qualified applicants may be contacted to review their resume in more detail.