Role & responsibilities
- 5+ of experience in handling SOAR platforms Swimlane , Cortex XSOAR , Splunk SOAR , Azure Logic Apps, etc.
- Hands-on experience in SOAR Implementation
- Key member of the Security automation team responsible for driving overall security automation strategy, defining and providing input for product roadmaps, managing the development and day to day operations of orchestration products, and solutions
- Design and implement recent features, technologies and solutions which help reduce mean-time-to-resolution of security events, threats and/or incidents
- Develop playbooks for automation use cases on SOAR platforms.
- Understand the security processes & develop playbooks for automation of processes.
- Create dashboards & case management in SOAR platforms.
- Develop custom Python packages to normalize disperse data sources to help our SOC make informed, data-driven decisions
- Lead the design and development of automated frameworks for Security Tools by leveraging a mix of scripting languages, open-source tools or COTs products
- Act as the point of contact for assigned projects
- Serve as an interface to our Security Operations Center (SOC) for key Incident Response, and Threat Intelligence use case automation development initiatives leading to; designing solutions that converts analyst use cases into automation pipelines using COTS and/or Open-source products. Additionally, enhancing automation pipelines by developing custom response actions / workflows to enhance automated responses
- Act as the connection point between the SOC/Threat/IR and Orchestration & Automation team to solve complex problems. Determine operational feasibility by evaluating problem scope/definition, requirements, and provide proposed solutions
- Play a critical role in automating specific SOC roles/functions out of existence
- Develop, test, and implement out-of-the-box approaches to identify malicious and suspicious behavior in logs, network traffic or other network foren