Security Orchestration and Automation

As part of this profile, the resource will perform the following:

Platform Management and Administration

Manage, administer, and support the SOAR platform

(Preferable Crowd Strike Falcon Fusion SOAR , including:

o Master Console

o SOAR SME

o SOAR Agents

o Platform updates, configuration management, and issue resolution

Connector and Integration Management

Monitor, troubleshoot, and resolve issues with SOAR connectors and system integrations.

Ensure seamless and continuous data exchange between SOAR and all integrated security solutions (e.g., SIEM, EDR, firewall, threat intel, ticketing).

Backup and Configuration Management

Perform monthly backups of SOAR:

o Playbooks

o Configuration data

o System settings and alerts

o Agent and SME nodes

Vendor Coordination

Act as the primary point of contact with Fortinet for:

o Issue escalation and troubleshooting

o Platform patches and upgrades

o Enhancement requests and license tracking

Track and close vendor support tickets in accordance with SLA timelines.

Platform Health and Optimization

Conduct quarterly health checks to assess:

o System performance and load handling

o Integration health and response accuracy

o Use case effectiveness

Recommend and implement enhancements to improve operational efficiency and incident response timelines.

Access Management and Governance

Manage user roles, permissions, and platform access control.

Conduct quarterly access reviews to ensure RBAC enforcement and privilege hygiene.

SOP Documentation and Knowledge Base

Document, maintain, and regularly update:

o Standard Operating Procedures (SOPs)

o Playbook logic flows

o Integration procedures and manual override guidelines





Performance Reporting

Provide periodic performance reports including:

o Playbook execution metrics

o Manual vs. automated response ratios

o Integration status

o SOC efficiency improvements via automation

Integration with Security Ecosystem

Integrate SOAR with:

o SIEM platforms

o Threat intelligence sources

o Incident ticketing tools

o Identity and access management platforms

Maintain alignment with MAFs overall security architecture.

Incident Response Support and Manual Decisioning

Support manual approval/denial workflows within playbooks (e.g., approval to block IOCs, isolate assets, trigger escalations).

Ensure proper documentation and SLA adherence for manual interventions.

Playbook Development and Expansion

Create, update, and maintain playbooks to:

o Automate routine tasks (e.g., IOC enrichment, phishing triage)

o Enhance response accuracy and consistency

o Reduce mean time to respond (MTTR)

Bidders must demonstrate their capability to expand SOAR use cases to drive operational maturity and incident handling speed.

New Connector Development

Develop and deploy recent connectors as needed to support integration with:

o New applications

o Infrastructure services

o Cloud and third-party APIs

Ensure connectors are tested, documented, and production ready.

Business Continuity and Disaster Recovery

Develop, maintain, and test BC/DR plans for SOAR platform components, agents, and database.

Validate system recovery processes and resilience against platform failure.

Disclaimer : This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 SENIOR ENGINEER - SOAR Concept (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru