Principal Security Engineer, Orchestration and Automation
Core
Building automation, orchestration, and AI-driven capabilities for security detection and response, treating the SIEM as part of a broader ecosystem to reduce manual analyst effort and scale coverage.
Role type
Principal Security Engineer (Orchestration and Automation)
Builds
Automated triage, enrichment, containment, and response workflows; AI/ML-assisted detection logic; unified integrations across security tool stacks.
Domain
Cybersecurity, Security Operations Center (SOC), SIEM/SOAR automation
Deliverable
production ML models | product features
Required skills
Python, SIEM engineering, SOAR platform expertise, AI/ML or LLM application in security, MITRE ATT&CK mapping, cloud security automation, CI/CD and infrastructure-as-code, containerized/serverless environment automation
Preferred skills
Security automation platform certification, regulatory compliance experience
Technologies
Python, SIEM platforms (e.g., NG-SIEM Fusion, Splunk, Palo Alto XSOAR), SOAR platforms (e.g., Tines), AWS/Azure/GCP, MITRE ATT&CK
Responsibilities
Design and maintain orchestration workflows and SOAR playbooks; develop Python-based integrations and APIs; tune SIEM correlation rules and detection use cases; administer core SIEM tasks (data onboarding, health, configuration); build custom field extractions and parsers; create dashboards for automation and detection metrics; pilot new automation and AI tooling.
Seniority
Senior, hands-on IC
