SOAR

SOAR Engineer Jobs

11 jobs found

Today

Cybersecurity Engineer (SOAR) [JOB ID 20260918]

Phoenix Cyber Arlington, VA

Arlington, VA

Today

$70k - $130k/yr Full time Cyber Security Incident Response Information Security

Apply Now

Job Description

Phoenix Cyber is seeking a Cybersecurity Engineer (SOAR) for an on-site role with a client delivery team in Arlington, VA. This position focuses on building cybersecurity solutions that improve how incidents are handled through security orchestrations and incident automations. The team operates in a fast-paced environment alongside like-minded, cross-functional engineers and stakeholders.

Salary range: USD 70,000 - 130,000 per year. Minimum experience requirement: 5 years. Education: Degree in a STEM related discipline.

Responsibilities

Apply technical expertise and real-world experience to create innovative cybersecurity solutions
Develop and implement automations in response to security incidents
Collaborate on the development and design of security orchestrations with SMEs/engineers, vendors, and project stakeholders
Adapt and contribute in a fast-changing, high-velocity environment with a cross-functional team

Requirements

Degree in a STEM related discipline and/or minimum 5 years of experience
2+ years of experience developing with Python
Working knowledge of scripting languages Bash and PowerShell
At least 3 years of experience in software development with COTS integration
Working knowledge of one or more programming languages such as C#, JavaScript, or Node.js
Experience with API development/consumption
Prior consulting experience

Technologies

Python, Bash, PowerShell, C#, JavaScript, Node.js
SOAR
API development/consumption
COTS integration

Nice to Have

Demonstrated proficiency in cyber security platforms: SOAR, SIEM, IDS/IPS, DLP, WAF, Endpoint Security
Experience deploying a SOAR tool in an Enterprise environment
Experience with SOAR tools: Swimlane, Cyber Triage, Phantom
Experience with container services (Docker, Kubernetes, etc.)
Linux administration experience
Cloud infrastructure experience (AWS, Google, or Azure)
Experience with the ELK stack (Elasticsearch, Logstash, Kibana), Elastic Cloud on Kubernetes (ECK), Kafka, Beats, and/or Splunk
Experience using Agile methodologies
Prior government or large enterprise experience
Government security clearance

View full job page →

1d ago

Senior Cybersecurity Engineer

Teleion Consulting Seattle, WA

Seattle, WA

1d ago

$155k - $200k/yr Contract Senior Azure Ad / Entra Id Cloud Platforms

Apply Now

Job Description

Teleion Consulting is hiring a hands-on, client-facing Senior Cybersecurity Engineer to help strengthen cloud security posture and operational readiness for real-world threats. This onsite contract role in Seattle, WA focuses on maturing incident response, advancing data protection, and improving zero trust capabilities across the Microsoft security ecosystem, including Sentinel, Defender, Entra, Intune, and Microsoft Purview.

You will directly support production client environments by configuring and operating Microsoft security tools, leading incident response activities end-to-end, and building durable detection and automation workflows that reduce noise and improve analyst efficiency. The role also includes improving security hygiene in Azure and multi-cloud settings through benchmark remediation and identity and entitlement risk reduction.

Responsibilities

Configure, tune, and operate the Microsoft security stack in production client environments, including Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Lead incident response for real security events such as account compromise, data exfiltration, insider risk, and BEC, covering containment, eradication, recovery, evidence preservation, and post-incident reporting.
Coordinate with MXDR or managed SOC providers on escalation quality, handoff, and case closure standards.
Author and maintain KQL analytic rules and hunting queries in Microsoft Sentinel, map detections to MITRE ATT&CK, close coverage gaps, and tune for signal quality and ingestion cost.
Develop SOAR playbooks to reduce false positive volume and automate analyst workflows.
Design, deploy, and tune Microsoft Purview DLP policies across email, endpoint, SharePoint, OneDrive, Teams, and cloud apps, moving findings to closure rather than alerting only.
Implement and maintain sensitivity labels, auto-labeling at scale, Insider Risk Management, and eDiscovery support.
Harden Azure and multi-cloud environments by remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Advance zero trust maturity across identity, device, network, application, and data pillars using Conditional Access, PIM, device compliance, and least-privilege access patterns.
Build PowerShell and Microsoft Graph API automations to scale security operations, reporting, and remediation.
Design and run tabletop exercises to test and mature the client’s incident response capability.

Requirements

7+ years of security engineering or security operations experience in enterprise environments.
Production-configured hands-on experience across the full Microsoft security stack: Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Microsoft Purview.
Demonstrated leadership of real security incidents through the full lifecycle, including containment, eradication, recovery, and post-incident reporting.
Strong KQL proficiency, including analytic rules, hunting queries, tuning for cost and signal quality, and mapping to MITRE ATT&CK.
Direct, demonstrable Microsoft Purview experience across DLP policy design and tuning, sensitivity labels, Insider Risk Management, and eDiscovery.
Experience hardening Azure environments: remediating Defender for Cloud findings, driving secure score improvement, and addressing cloud identity and entitlement risk.
Experience implementing zero trust controls across multiple pillars using Conditional Access and PIM (privileged access management).
PowerShell and Microsoft Graph API proficiency for security automation.
Experience coordinating with MXDR or managed SOC providers on escalation and case quality.
Certifications preferred: AZ-500, SC-200, SC-400, SC-100, GCIH, GCFA, or CISSP. Cloud and M365 digital forensics experience is a plus.

Benefits

Full benefits
PTO
Holiday
401(k)

Salary: USD 155,000 - 200,000 per year. Location: Seattle, WA (onsite). Job type: contract.

View full job page →

1d ago

Information Security Engineer

Intuitive Surgical Peachtree Corners, GA

Peachtree Corners, GA

1d ago

$124k - $210k/yr Full time Cyber Security Data Loss Prevention Data Security

Apply Now

Job Description

Join the IT Security organization at Intuitive Surgical and help strengthen protection across endpoints, cloud applications, and network environments. In this onsite role in Peachtree Corners, GA, you’ll administer and tune DLP controls, manage EDR and incident response orchestration, and support zero trust enforcement. The work focuses on investigating DLP and endpoint security activity, correlating telemetry, and contributing to continuous improvements in the company’s security posture.

What you’ll do

Administer and tune DLP policies and rules within enterprise DLP and SASE/CASB platforms to help prevent unauthorized data exfiltration across endpoints, cloud applications, and network egress.
Deploy and support EDR agents on Windows, macOS, and Linux, maintaining sensor health, policy enforcement, and telemetry collection.
Build SOAR workflows for automated incident response and orchestration to accelerate alert triage, enrichment, containment, and escalation across the security tooling stack.
Support ZTNA enforcement in coordination with Network Security so least-privilege access aligns with zero trust architecture principles.
Investigate DLP alerts, including root cause analysis, data classification at risk, coordination on policy exceptions with business stakeholders, and documentation for compliance and audit purposes.
Triage and classify endpoint events by severity and business impact, correlating telemetry from EDR, SIEM, and DLP platforms to identify threats and data exposure risks.
Troubleshoot endpoints across Windows, macOS, and Linux, including agent deployment issues, policy conflicts, OS-specific anomalies, and sensor communication failures.
Use Elasticsearch to develop and refine operational metrics and dashboards covering DLP effectiveness, endpoint coverage gaps, automation ROI, and incident response performance.
Collaborate on SIEM detections with Detection Engineering by creating and tuning rules addressing DLP bypass techniques, EDR evasion, and insider threat indicators.
Partner during escalations with Incident Response and Investigations teams by providing endpoint forensic data, DLP event context, and automation support across the incident lifecycle.
Support internal investigations (including insider threat and policy violations) using DLP, EDR, and SIEM for evidence collection and forensic analysis.
Handle sensitive information with discretion while maintaining confidentiality throughout the investigative lifecycle, including privileged findings and personnel matters.

Qualifications

Minimum 2 years of experience.
Hands-on experience administering and tuning enterprise DLP and SASE/CASB solutions across endpoint, cloud, and network enforcement points.
Experience deploying, managing, and troubleshooting EDR platforms across Windows, macOS, and Linux.
Demonstrated ability to troubleshoot endpoints across Windows, macOS, and Linux, including agent lifecycle management, OS-level diagnostics, and policy conflict resolution.
Understanding of OS internals for Windows, macOS, and Linux, including file systems, process management, registry/plist configuration, logging subsystems, and kernel-level behaviors relevant to security tooling.
Working knowledge of ZTNA concepts and technologies, including identity-aware access controls, micro-segmentation, and least-privilege network policies.
Experience building SOAR automation and orchestration workflows for incident triage, enrichment, and response.
Familiarity with SIEM platforms and Elasticsearch for log analysis, alert correlation, and dashboard development.
Strong communication skills to convey technical findings to IT teams, engineering stakeholders, and business partners in a matrixed organization.
Demonstrated ability to handle sensitive and confidential information with discretion, including investigation findings, personnel data, and legal hold materials.
Investigative mindset: curiosity, attention to detail, methodical evidence handling, objectivity, and ability to build a factual narrative from disparate data sources.
Degree in a technical related field (or additional related experience).

Technologies

DLP, SASE/CASB, EDR, SOAR, ZTNA, Elasticsearch, SIEM, Windows, macOS, Linux

Compensation & workplace details

Salary: USD 124,200 - 210,300 per year (base range varies by region).
Shift: Day.
Workplace type: Set schedule. Onsite weekly, with the onsite percentage defined by the leader.

Additional information

Due to the nature of the business and the role, Intuitive and/or customer(s) may require proof of vaccination against certain diseases including COVID-19. Details can vary by role.
Equal Opportunity Employer.
U.S. Export Controls may apply for prospective employees who are nationals from countries on embargo or sanctions status.
Accommodation & Accessibility: Intuitive provides reasonable accommodations. Contact HRHelpNow@intusurg.com for assistance during application or interview.

Preferred skills and experience

Experience in a SOC, incident response, or DLP operations function supporting enterprise-level environments.
SANS/GIAC certification(s) strongly preferred (e.g., GCFE, GCFA, GCED, GCIH, GCIA, GDSA, or GREM). CISSP or CompTIA Security+ are a plus.
Experience operating across a mature enterprise security stack spanning EDR, DLP, SASE/CASB, SOAR, SIEM, ZTNA, next-generation firewalls, identity providers, and email security gateways.
Experience developing automated playbooks for DLP incident handling, endpoint isolation, or threat enrichment workflows.
Understanding of insider threat detection methodologies, data classification frameworks, and regulatory requirements relevant to medical device or healthcare organizations (e.g., HIPAA, FDA).
Experience conducting or supporting workplace investigations, forensic examinations, or e-discovery processes in a corporate environment.
Familiarity with chain-of-custody procedures, legal hold requirements, and evidence preservation standards.
Prior systems administration experience across Windows, macOS, or Linux, including working understanding of Active Directory, group policy, endpoint management, and OS-level security hardening.

View full job page →

1d ago

Cyber - AI Engineer - Senior - Consulting

EY New York, NY

New York, NY

1d ago

$105k - $210k/yr Full time Ai Engineer Artificial Intelligence Automation

Apply Now

Job Description

In EY’s Cyber practice, this role supports clients as a forward-deployed engineer, helping teams translate frontier AI cyber capabilities into practical security outcomes. You’ll build, evaluate, and deploy AI solutions that move from prototype through production while partnering with technical and engagement leadership.

This senior consulting position is based in New York, NY (onsite) and focuses on applying advanced AI workflows to areas such as threat investigation, detection engineering, and vulnerability analysis.

Role Focus

Help clients apply frontier AI cyber models to real security challenges.
Build, evaluate, and deploy AI solutions from prototype to production with guidance from technical and engagement leaders.
Collaborate with client security and engineering teams to deploy AI workflows for threat investigation, detection engineering, vulnerability analysis, and remediation support.
Use retrieval, tool calling, and structured outputs.

Technical Responsibilities

Develop evaluation datasets and test harnesses to measure accuracy, false positives, task completion, latency, and cost.
Own assigned technical deliverables, including task estimation and clear communication of progress and risks to engagement leaders.
Contribute to architecture, pair programming, code reviews, and integration troubleshooting, while supporting Consultants.
Work with model providers and researchers to test cyber capabilities and document deployment findings.
Support technical demonstrations, proposals, and reusable assets such as evaluation suites and delivery playbooks.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field, plus 3–5 years of relevant experience, including hands-on software engineering and experience building or deploying AI/ML solutions.
Proficiency in Python, APIs, Git, automated testing, and production delivery.
Experience applying frontier AI models or LLM applications to cybersecurity.
Experience with agents, model tool integrations, retrieval pipelines, and evaluation harnesses.
Experience in security operations, threat investigation, detection engineering, or incident response automation.
Experience with DevSecOps, CI/CD, containers, and infrastructure-as-code for AI services.
Experience with cloud engineering and secure AI deployment on AWS, Azure, or GCP.
Experience integrating APIs with SIEM, SOAR, EDR, vulnerability management, or code security platforms.
Experience with application security, vulnerability analysis, secure code review, or automated remediation.
Understanding of prompt injection, data leakage, unsafe tool use, and safeguards informed by OWASP Top 10 for LLMs and MITRE ATLAS.
Working knowledge of security architecture, identity and access management, data protection, and secure AI operations.
Experience contributing to client-facing delivery or cross-functional engineering, from requirements through deployment and handover.
Strong writing, presentation, and technical documentation skills.
Willingness to travel based on client and business needs, estimated at 25–50%.

Technologies

Python, APIs, Git, automated testing
DevSecOps, CI/CD, containers, infrastructure-as-code
AWS, Azure, GCP
SIEM, SOAR, EDR
OWASP Top 10 for LLMs, MITRE ATLAS

Benefits

Medical and dental coverage
Pension and 401(k) plans
A wide range of paid time off options

Additional Qualifications (Ideally)

Cybersecurity (for example, CISSP, CCSP), cloud, engineering, or AI/ML certifications.
Experience with frontier model providers or cyber-focused model selection, adaptation, and evaluation.
Experience with agent orchestration, model serving, LLM observability, and CI/CD evaluation gates.
Knowledge of adversarial testing, AI red teaming, sandboxing, and safeguards for authorized dual-use cyber work.
Experience with data residency, privacy, model access, and deployment in regulated or restricted environments.
Experience contributing to engineering workshops, live prototyping, architecture reviews, and client demos.
Experience building cyber evaluation datasets, fine-tuning models, or contributing to open-source AI or security projects.
Forward-deployed engineering or consulting experience supporting production deployments and client teams.

Salary and Location Details

Salary range listed for USD 104,800 - 209,700 per year.
New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices: $125,800 to $209,700
Bay Area California offices: $131,100 to $218,500
All other US offices (including Sacramento): $104,800 to $192,200
Individual salaries are determined based on factors including education, experience, knowledge, skills, and geography.

How to Apply

Please limit applications to two within a six-month period to make the most of your application experience.
EY accepts applications for this position on an ongoing basis.
For those living in California, additional information is available via a provided link.
EY notes that misrepresentation, falsification, or lack of integrity during the recruiting process may result in withdrawal of candidacy, revocation of an offer, or termination of employment.

View full job page →

19d ago

Security Engineer

Neptune Technology Group Inc. Duluth, GA

Duluth, GA

19d ago

Full time Cloud Platforms Data Loss Prevention Edr And Xdr

Apply Now

Job Description

The Security Engineer will operate within Neptune Technology Group Inc.’s Security Operations Center (SOC), where the role designs, implements, administers, and optimizes cybersecurity technologies. This position also provides technical leadership for incident detection, investigation, response, and remediation while driving continuous improvements through engineering and process enhancements.

Onsite Location

Duluth, GA (onsite)
Duluth, GA, Tallassee, AL

Role Responsibilities

Design, configure, implement, and maintain security platforms including SIEM, EDR/XDR, SOAR, Identity and Access Management (IAM), Data Loss Prevention (DLP), Vulnerability Management, and Cloud Security solutions
Evaluate, test, and deploy new security technologies, including Proof of Concept (POC) evaluations
Develop automation and orchestration workflows to improve operational efficiency
Support cloud security and Zero Trust initiatives across the enterprise
Develop and tune security detections, correlation rules, and dashboards to improve threat detection while reducing false positives
Conduct proactive threat hunting and analyze security telemetry across endpoints, network, identity, cloud, and SIEM platforms
Identify opportunities to strengthen detection and response capabilities across the environment
Monitor emerging threats, vulnerabilities, and industry best practices to inform detection strategy
Provide technical leadership during complex and escalated incident activities, including investigation, containment, eradication, and recovery
Investigate advanced cyber threats and complex security alerts
Collect and analyze forensic artifacts, logs, and endpoint telemetry during investigations
Participate in an on-call rotation and provide advanced technical support during critical incidents
Support root cause analysis and post-incident reviews
Validate vulnerability findings and coordinate remediation activities with IT Operations, Infrastructure, and Engineering teams
Implement security controls to address identified risks and track remediation efforts within the vulnerability management program
Partner with SOC Analysts, IT Operations, Infrastructure, Cloud, and Engineering teams to implement and maintain security solutions
Develop response playbooks, engineering standards, and operational procedures
Mentor SOC Analysts through technical guidance and support
Create and maintain technical documentation supporting SOC operations
Collaborate with Neptune’s MSSP and third-party security partners on engineering and investigation initiatives
Support compliance initiatives aligned with NIST CSF, CIS Controls, ISO 27001, and Roper Cybersecurity requirements
Recommend improvements to strengthen Neptune’s security posture, resilience, and compliance
Assist with audit requests, evidence collection, and security documentation

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience)
2–5 years of experience in cybersecurity, security operations, incident response, or a related technical field
Experience investigating security alerts, detections, and cybersecurity incidents
Experience working in a Security Operations Center (SOC) environment
Experience with SIEM and EDR platforms
Understanding of security engineering concepts, including detection engineering, automation, and security tool administration
Strong analytical, troubleshooting, and problem-solving skills
Strong written and verbal communication skills

Relevant Technologies

SIEM
EDR/XDR
SOAR
Identity and Access Management (IAM)
Data Loss Prevention (DLP)
Vulnerability Management
Cloud Security solutions
CrowdStrike Falcon
Google SecOps (Chronicle)
Microsoft Defender
Microsoft Entra ID (IAM)
Cloud Security Platforms (AWS, Azure)
MITRE ATT&CK Framework
PowerShell
Python
NIST CSF
CIS Controls
ISO 27001
Roper Cybersecurity requirements

Expected Platform Experience

CrowdStrike Falcon
Google SecOps (Chronicle)
Microsoft Defender
SIEM Platforms
Endpoint Detection and Response (EDR) Platforms
Security Orchestration, Automation, and Response (SOAR)
Identity and Access Management (IAM) / Microsoft Entra ID
Data Loss Prevention (DLP)
Cloud Security Platforms (AWS, Azure)
Vulnerability Management Platforms

Preferred Qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or related field
2–5 years of experience in Security Operations, Cybersecurity, Incident Response, Vulnerability Management, or Information Technology
Experience with SIEM platforms such as Google SecOps, Chronicle, Splunk, QRadar, Microsoft Sentinel, or similar technologies
Experience with EDR platforms such as CrowdStrike Falcon or Microsoft Defender
Familiarity with the MITRE ATT&CK Framework, threat hunting, and threat intelligence methodologies
Experience supporting vulnerability management programs and remediation activities
Knowledge of Windows, Active Directory, Microsoft Entra ID, networking fundamentals, and cloud security concepts
Experience working with AWS and/or Azure environments
Familiarity with NIST Cybersecurity Framework, CIS Controls, ISO 27001, and security best practices
Experience with scripting or automation using PowerShell, Python, or similar languages

Certifications (Preferred)

Security+
CySA+
GSEC
GCIH
GCIA
GCED
CISSP (Associate or Full)
SC-200
SC-100
CrowdStrike Certifications
Google SecOps Certifications
AWS or Azure Security Certifications

Education

Bachelor’s Degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or related field preferred
Equivalent military, technical, or professional experience will be considered

Travel Requirements

Typically requires overnight travel less than 10% of the time

Experience Level

Minimum experience: 2 years
Years of experience (IT, Security & Compliance): 2–5 years

View full job page →

24d ago

Web Security Engineer

Brown Brothers Harriman Jersey City, NJ

Jersey City, NJ

24d ago

$85k - $130k/yr Full time Cloud Platforms Data Loss Prevention Data Security

Apply Now

Job Description

This Web Security Engineer role sits in Brown Brothers Harriman’s Cybersecurity team within the Protect Pillar in Systems, focused on defending against web-based threats and operating secure web gateway and proxy platforms.

Responsibilities

Protect the firm from web-based threats, including malware, phishing, and attempts at data exfiltration
Prevent web-originated threats from entering or impacting the environment
Partner with incident response teams to detect and remediate web-originated threats
Design, implement, and maintain enterprise web filtering proxies
Architect, build, and provide ongoing support for secure web gateway and cloud proxy platforms
Ensure scalability and availability of web security services
Align web security capabilities with Zero Trust principles
Develop and enforce security policies, including:
- Web filtering
- SSL inspection
- DLP (data loss prevention)
- Threat-prevention policies
Translate regulatory and privacy requirements into technical controls
Automate and integrate security operations to support monitoring and response
Use APIs and tooling to automate policy management, monitoring, and response
Integrate web security workflows with SIEM, SOAR, and identity platforms
Support business use cases by identifying, prioritizing, and enabling secure web access aligned with business needs
Provide reporting and governance, including regular communication of key metrics, risks, and program maturity to leadership

Requirements

Minimum 8 years of experience in information security and web-based security technologies, preferably in financial services
5+ years of web proxy experience
Knowledge of cybersecurity and privacy regulations and the risks associated with them
Excellent analytical and communication skills

Technologies

Zero Trust
Web filtering proxies
Secure web gateway
Cloud proxy platforms
SSL inspection
DLP
Threat-prevention policies
APIs
SIEM
SOAR

Benefits

Annual target bonus
Base salary + annual target bonus
Discretionary bonuses
Profit-sharing
Benefits that support long-term savings, healthcare, and income protection
Professional development opportunities
Time off

Compensation

NJ: $100,000 - $130,000 base salary + annual target bonus
MA: $85,000 - $130,000 base salary + annual target bonus

Team and Pillar Context

The Cybersecurity team is part of the Protect Pillar in Systems
The Protect Pillar is a BBH construct designed for clear, centralized, and coordinated accountability:
- Protect against physical and logical security risks
- Safeguard stakeholder assets
- Detect, prepare for, and respond effectively to security events
The Protect Pillar encompasses:
- Cybersecurity
- Enterprise Data Protection and Data Governance
- Enterprise Incident Management
- Global Security
- Information Security Management (ISM)
Because technology is integral to Pillar control measures and an asset to safeguard, the Protect Pillar sits within BBH’s Systems organization

Equal Opportunity and Application Guidance

We value diverse experiences and transferrable skillsets
If your career path is non-traditional, includes alternative experiences, or you do not meet every qualification listed, apply anyway

View full job page →

1mo ago

Principal Threat Intelligence Engineer

UnitedHealth Group Washington, DC 🇺🇸 Remote

Washington, DC

1mo ago Closed

$113k - $193k/yr Full time Agentic Ai Artificial Intelligence Cybersecurity Tools

This position is no longer accepting applications (closed Sep 5, 2026).

Job Description

UnitedHealth Group is seeking a Principal Threat Intelligence Engineer to expand and integrate threat intelligence capabilities across its security ecosystem. In this role, you will help operationalize intelligence-led detection and response by ingesting, normalizing, enriching, and automating threat data workflows used by CTI, SOC, IR, and other SecOps teams.

This position is based in Washington, DC with a remote work setup and a salary range of USD 112,700 to 193,200 per year. A minimum of 3+ years of relevant experience is required.

What you’ll do

Deploy, integrate, and maintain a threat intelligence platform integrated into United Health’s security tooling ecosystem
Integrate threat intelligence into SIEM platforms (example: Splunk) to support detection use cases and alert enrichment
Use agentic AI, LLMs, and related capabilities to improve the speed and availability of contextualized threat intelligence for CTI, SOC, IR, and other SecOps teams
Build and deploy technology-supported workflows to run intelligence use cases across environments including SOC, IR, Insider Risk, Fraud, Red Team, and Threat Hunt
Develop and maintain SOAR playbooks for automated threat response and enrichment, leveraging SOAR to optimize intelligence workflows
Orchestrate workflows across security tools to reduce manual analysis and improve response time
Build and maintain integrations between threat intelligence feeds (commercial, open-source, ISACs) and internal security platforms
Integrate and operationalize TIPs such as MISP, OpenCTI ThreatConnect, Anomali, and ThreatQuotient with enterprise security tools
Create pipelines to ingest, normalize, deduplicate, and enrich Indicators of Compromise (IOCs) and threat data
Correlate intelligence with telemetry from SIEM, EDR, NDR, and cloud security tools to improve detection fidelity
Enable automated enrichment of alerts using threat intelligence data within SIEM workflows

Required qualifications

3+ years of experience in a cyber threat intelligence, cyber security engineering, incident response, or malware analysis role with a strong emphasis on tool and technology integration
Proficiency in Python (primary) for automation, API integrations, and data processing
Proficiency in one or more of: Java, JavaScript/Node.js, or Go for service development
Experience with REST APIs, JSON, and STIX/TAXII protocols
Experience with data parsing, transformation, and pipeline development
Experience with scripting in Bash and/or PowerShell
Demonstrated familiarity with Git and CI/CD pipelines
Demonstrated familiarity with OSes and platforms including Linux (Ubuntu, CentOS, RHEL, Kali), AWS, Docker, Windows Server (NT through 2012), Active Directory, and Mac OS X
Experience applying AI within a threat intelligence framework, including LLM, MCP server configuration, RAG, and related processes
Hands-on experience with TIPs such as MISP, OpenCTI, ThreatConnect, and Anomali
Experience integrating multiple intelligence feeds and formats
Solid experience with SIEM platforms: Splunk, Microsoft Sentinel, IBM QRadar, Elastic
Experience building detection rules, correlation searches, and dashboards
Proven understanding of log ingestion, normalization, and enrichment pipelines
Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, Swimlane, and Tines
Development experience with playbooks/runbooks for automated response
Proven knowledge of structured threat data formats: STIX and TAXII

Technologies you may work with

Python, Java, JavaScript/Node.js, Go
REST APIs, JSON, STIX/TAXII
Bash, PowerShell, Git, CI/CD
Linux (Ubuntu, CentOS, RHEL, Kali), AWS, Docker
Windows Server (NT through 2012), Active Directory, Mac OS X
LLMs, MCP server configuration, RAG
MISP, OpenCTI, ThreatConnect, Anomali, Splunk, Microsoft Sentinel, IBM QRadar, Elastic
Cortex XSOAR, Splunk SOAR, Swimlane, Tines
ThreatQuotient, EDR, NDR, IOcs, TIPs, SIEM, SOAR

Benefits

Comprehensive benefits package
Incentive and recognition programs
Equity stock purchase
401k contribution (all benefits are subject to eligibility requirements)

Preferred qualifications

Relevant certifications (examples: GCTI, GCIA, CISSP, Splunk certifications)
Experience in large-scale security operations or SOC environments
Familiarity with MITRE ATT&CK and other intelligence frameworks
Familiarity with data engineering technologies (examples: Kafka, Spark, Elasticsearch)
Experience with cloud platforms (AWS, Azure, GCP) and security integrations
Experience in threat hunting and detection engineering