Lead Security Automation Engineer

Key Responsibilities & Accountabilities Develop and optimize automation workflows within Hyperautomation or other SOAR platforms (e.g., XSOAR, Splunk SOAR, LogicHub, Swimlane) Build API integrations between security tools such as SIEMs, EDRs, XDRs, case management systems, and cloud platforms Extensively work with JSON formatting, parsing, and data transformations to enable seamless data exchange across multiple security platforms Streamline incident response automation to improve efficiency, reduce MTTR, and enhance security event correlation Design and maintain fault-tolerant automation processes that scale across thousands of clients Maintain and optimize CI/CD pipeline infrastructure within a SOAR platform Collaborate with SOC analysts, DFIR teams, and threat intelligence groups to refine and enhance automation capabilities Lead migration projects to improve automation platforms, ensuring seamless transitions without impacting security operations Continuously evaluate and implement emerging automation techniques to enhance SOC and MSSP workflows Must-Have Skills & Experience 1+ years of experience in security automation, SOAR engineering, or cybersecurity automation within an MSSP, DFIR, or enterprise security environment Extensive experience working with JSON, including JSON schema design, manipulation, parsing, and API-based data transformations Strong scripting skills in Python, PowerShell, JavaScript or Bash for workflow automation Proficiency in API development and integration, including RESTful APIs, JSON-based APIs and webhook automation Experience working with SIEM (Splunk, Sentinel, QRadar, Rapid7 IDR, etc.) and EDR/XDR tools (Crowdstrike, SentinelOne, Cortex XDR, Stellar Cyber, etc.) Familiar with Ansible and DORA practices Nice-to-Have Skills Experience in multi-client environments (MSSP, IR firms, or security service providers) Hands-on experience with hyperautomation, XSOAR, Splunk SOAR, or similar platforms Certifications CompTIA Security+, AWS/Azure Security Certifications Proficiency in using JQ filters for data manipulation Experience automating cloud security workflows (AWS, Azure, Google Cloud) Familiarity with case management automation and cross-platform data normalization Prior experience leading SOAR migration projects or developing custom security playbooks