Security Orchestration and Automation

As part of this profile, the resource will perform the following:

Platform Management and Administration

- Manage, administer, and support the SOAR platform

(Preferable CrowdStrike Falcon Fusion SOAR, Including

- Master Console
- SOAR SME
- SOAR Agents
- Platform updates, configuration management, and issue resolution

Connector and Integration Management

- Monitor, troubleshoot, and resolve issues with SOAR connectors and system integrations.
- Ensure seamless and continuous data exchange between SOAR and all integrated security solutions (e.g., SIEM, EDR, firewall, threat intel, ticketing).

Backup and Configuration Management

- Perform monthly backups of SOAR:
- Playbooks
- Configuration data
- System settings and alerts
- Agent and SME nodes

Vendor Coordination

- Act as the primary point of contact with Fortinet for:
- Issue escalation and troubleshooting
- Platform patches and upgrades
- Enhancement requests and license tracking
- Track and close vendor support tickets in accordance with SLA timelines.

Platform Health and Optimization

- Conduct quarterly health checks to assess:
- System performance and load handling
- Integration health and response accuracy
- Use case effectiveness
- Recommend and implement enhancements to improve operational efficiency and incident response timelines.

Access Management and Governance

- Manage user roles, permissions, and platform access control.
- Conduct quarterly access reviews to ensure RBAC enforcement and privilege hygiene.

SOP Documentation and Knowledge Base

- Document, maintain, and regularly update:
- Standard Operating Procedures (SOPs)




- Playbook logic flows
- Integration procedures and manual override guidelines

Performance Reporting

- Provide periodic performance reports including:
- Playbook execution metrics
- Manual vs. automated response ratios
- Integration status
- SOC efficiency improvements via automation

Integration with Security Ecosystem

- Integrate SOAR with:
- SIEM platforms
- Threat intelligence sources
- Incident ticketing tools
- Identity and access management platforms
- Maintain alignment with MAFs overall security architecture.

Incident Response Support and Manual Decisioning

- Support manual approval/denial workflows within playbooks (e.g., approval to block IOCs, isolate assets, trigger escalations).
- Ensure proper documentation and SLA adherence for manual interventions.

Playbook Development and Expansion

- Create, update, and maintain playbooks to:
- Automate routine tasks (e.g., IOC enrichment, phishing triage)
- Enhance response accuracy and consistency
- Reduce mean time to respond (MTTR)
- Bidders must demonstrate their capability to expand SOAR use cases to drive operational maturity and incident handling speed.

New Connector Development

- Develop and deploy new connectors as needed to support integration with:
- Recent applications
- Infrastructure services
- Cloud and third-party APIs
- Ensure connectors are tested, documented, and production ready.

Business Continuity and Disaster Recovery

- Develop, maintain, and test BC/DR plans for SOAR platform components, agents, and database.
- Validate system recovery processes and resilience against platform failure.

SOAR Concept

📌 SENIOR ENGINEER - SOAR Concept (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru