SOAR Automation + SIEM Engineering

Job Description:

The Cyber Automation enables Cyber Defence organizational goal of detecting in seconds and responding in minutes by making security data consumable by the teams that need it, and by automating their security actions and processes. This position focuses on both developing automation workflows and enabling new capabilities in the Security Orchestration, Automaton, and Response (SOAR) platform. The process of developing automation workflows requires working with various Cyber Defence teams and will enrich your understanding of cyber security concepts, practices, and tooling.

Responsibilities of this Position

• Translate automation requests from the various Cyber Defence teams into secure and reliable automations that enable new capabilities, save time, reduce costs, and ensure process execution consistency.
• Implement new interfaces between the SOAR platform and security tools and other information systems in the constantly changing IT ecosystem.
• Implement Artificial Intelligence (AI) services into automations to unlock additional value and capabilities.
• Be an integral part of the automation team where ongoing cross-skilling and knowledge sharing is essential.
• Be an automation focal point to one or more Cyber Defence teams, understanding their specific needs and keeping them informed about automation delivery, and enabling them to take advantage of DIY automation options.

Requirements Experience and Qualifications

• Minimum of 3 years of experience in IT security or IT engineering.
• Experience working with various Microsoft Azure cloud services including:
• Integration Services: Logic Apps, API Management
• Compute Services: Azure Functions, Virtual Machines
• Storage Services: Data Lake Storage, Blob Storage, Azure Files
• Database Services: Cosmos DB, SQL Database, PostgreSQL
• Identity and Security: Microsoft Entra ID, Azure Key Vault
• Experience working with developer tools including GitHub, Azure DevOps, and Visual Studio Code.
• Experience with data query languages including Kusto Query Language (KQL), Splunk Search Processing Language (SPL), Structured Query Language (SQL).
• Coding experience in Python, PowerShell, JavaScript, and Azure Bicep.
• Experience with Windows and Linux operating systems administration and an understanding of networking concepts.
• Preferably has knowledge of using and integrating Artificial Intelligence (AI) services such as Azure OpenAI or Azure AI Foundry.
• Preferably has Microsoft professional certifications relating to Security Operations, Azure Security, Azure Administration, Azure Development and Automation, etc.
• Preferably has security processional certification in SPLUNK, SSCP, CISSP, SANS, etc.
• Demonstrates an understanding of the issues of interest to the organisation and proposes viable solutions within the scope of own expertise, considering the needs of those affected.
• Develops and maintains knowledge of IT security and maintains an awareness of current developments.
• Has good written and verbal communication skills and provides well-informed advice.