Why Mizuho

At Mizuho, we provide the stability of an international industry leader with the career trajectory of a growing business. Our steady, strategic growth gives our people at all levels rewarding degrees of responsibility and richer work experience than a boutique firm or an established giant could offer alone.

It’s the local expertise of our employees that makes our global network so powerful. By collaborating with colleagues and clients who share the same ambition and drive, you can amplify your sphere of influence and base of knowledge as part of one of the largest banks in the world.

Role Overview:

We are looking for an experienced Security Automation & SOAR Engineer with strong hands-on expertise across Palo Alto Cortex XSOAR and Microsoft Sentinel. The role will be responsible for the design, development, integration, migration, optimization, and operational support of security orchestration and automation capabilities supporting Security Operations.

The engineer will work closely with SOC, Incident Response, Threat Intelligence, Threat Hunting, Vulnerability Management, IAM, and engineering teams to automate security processes, integrate security technologies, improve analyst efficiency, and support the migration and modernization of SOAR capabilities.

The successful candidate must demonstrate strong software engineering, troubleshooting, and automation skills and be capable of independently developing and supporting complex playbooks, scripts, APIs, and integrations.

Roles & Responsibilities:

SOAR Engineering & Automation:

- Design, develop, test, deploy, and maintain security automation workflows across Palo Alto Cortex XSOAR and Microsoft Sentinel.
- Develop and troubleshoot Cortex XSOAR playbooks, automations, scripts, integrations, and incident workflows.
- Develop Microsoft Sentinel automation rules, Logic Apps, and security response playbooks.
- Build reusable automation components using Python, Java, PowerShell, REST APIs, JSON, and webhooks.
- Automate security use cases including:
- Phishing investigation and response
- Compromised account response
- Malware and endpoint investigation
- Threat intelligence enrichment
- Indicator enrichment and blocking
- Identity-related investigations
- Incident enrichment and prioritization
- Automated containment and remediation
- Implement appropriate error handling, logging, exception management, and human approval points within automated workflows.
- Troubleshoot failed playbooks, integrations, APIs, scripts, and automation dependencies.
- Establish disciplined development, testing, version control, and deployment practices for security automation.

Integration Engineering:

- Design, develop, and maintain integrations between Cortex XSOAR, Microsoft Sentinel, and enterprise security platforms.
- Integrate SOAR platforms with technologies including Microsoft Defender, Palo Alto Networks, CrowdStrike, CyberArk, Entra ID, Active Directory, ServiceNow, email security, threat intelligence, and vulnerability management platforms.
- Develop custom integrations where native capabilities do not meet operational requirements.
- Build and troubleshoot REST API-based integrations, including authentication, authorization, certificates, secrets, data mapping, and error handling.
- Establish reusable and supportable integration patterns across Security Operations.
- Monitor integration health, dependencies, failures, and performance.




- Maintain integration inventories, technical documentation, and architecture diagrams.

SOAR Migration & Modernization:

- Support the migration, consolidation, and modernization of security automation capabilities between SOAR platforms, including Cortex XSOAR and Microsoft Sentinel.
- Assess existing playbooks, integrations, scripts, workflows, and platform dependencies.
- Map source-platform workflows, data structures, APIs, integrations, incident models, and automation logic to target-platform capabilities.
- Re-engineer and optimize automation where appropriate rather than simply replicating legacy workflows.
- Identify redundant, duplicate, or obsolete playbooks and integrations during migration.
- Support migration activities across:
- Discovery and dependency analysis
- Use-case and playbook mapping
- Architecture and design
- Development and integration
- Functional and regression testing
- Parallel validation
- Production cutover
- Stabilization and operational handover
- Maintain traceability between existing and migrated automation to identify functional or coverage gaps.
- Support migration cutover and rollback planning to minimize disruption to Security Operations.
- Develop migration documentation, dependency maps, test evidence, architecture diagrams, and operational runbooks.

Microsoft Sentinel & Detection Engineering:

- Support Microsoft Sentinel engineering, including data connectors, telemetry ingestion, normalization, platform health, and optimization.
- Develop and tune KQL queries, analytics rules, correlation logic, and hunting queries.
- Connect security detections with appropriate automated investigation and response workflows.
- Support telemetry integration across endpoint, identity, network, cloud, email, and enterprise applications.
- Partner with detection engineering teams to align relevant detections and response workflows with MITRE ATT&CK;.

Engineering Governance & Operational Support:

- Implement Git/source control, code review, testing, CI/CD, and controlled release practices for security automation.
- Maintain playbook catalogs, integration inventories, technical documentation, architecture diagrams, and operational runbooks.
- Monitor automation reliability and effectiveness and identify opportunities to reduce repetitive manual activity.
- Troubleshoot production issues affecting SOAR platforms, playbooks, APIs, and integrations.
- Partner with SOC and Incident Response teams to translate manual processes into scalable automation.
- Provide technical knowledge transfer and support to SOC analysts and security engineering teams.
- Participate in production support and major incident activities for critical automation and platform issues as required.

Required Experience & Technical Skills:

- 8+ years of cybersecurity or Security Operations engineering experience, with significant experience in SIEM/SOAR and security automation.
- Strong hands-on Palo Alto Cortex XSOAR engineering experience, including playbook development, custom automation, integrations, scripts,



and troubleshooting.
- Strong hands-on Microsoft Sentinel automation experience, including automation rules, Azure Logic Apps, playbooks, and security orchestration.
- Strong software development and scripting capability with hands-on experience in Python and Java.
- Strong experience developing and troubleshooting REST APIs, JSON, webhooks, and API-based integrations.
- Experience with authentication and authorization mechanisms used in enterprise integrations, including OAuth, API keys, certificates, and secrets.
- Hands-on experience integrating SOAR platforms with EDR, IAM/PAM, ITSM, threat intelligence, vulnerability management, email security, and other security technologies.
- Experience migrating, re-engineering, or modernizing SOAR playbooks, scripts, integrations, and workflows between platforms.
- Strong KQL capability for Microsoft Sentinel detection, investigation, and hunting use cases.
- Experience with PowerShell and Microsoft security automation.
- Experience with Git/source control, testing, code review, CI/CD, and structured change-management practices.
- Strong troubleshooting skills across APIs, authentication, networking, automation workflows, and security platforms.
- Ability to translate Security Operations processes into scalable, maintainable, and supportable automation.

Preferred / Nice-to-Have Skills:

- Experience with JavaScript and other scripting languages.
- Experience developing Cortex XSOAR custom integrations and Content Packs.
- Familiarity with Demisto SDK and XSOAR content-development practices.
- Experience with Cortex XSIAM.
- Experience with Microsoft Defender XDR and the wider Microsoft security ecosystem.
- Experience developing ServiceNow integrations and automated security workflows.
- Experience with Terraform and/or Ansible.
- Experience implementing CI/CD and automated testing for security automation content.
- Experience with cloud environments, including Azure, AWS, and GCP.
- Relevant Palo Alto Networks and Microsoft security certifications.
- Experience delivering security automation and SOAR migration within a large, regulated enterprise environment.

Company Overview:

Mizuho Pune is an integral part of Mizuho Financial Group, one of the world’s leading financial institutions with a robust global presence across the Americas, EMEA, and Asia. Based in India, Mizuho Pune supports Mizuho’s international businesses by delivering high-quality, scalable, and resilient services across multiple functions.

Mizuho Pune plays a critical role in driving operational excellence, standardization, and innovation for Mizuho Americas. By combining deep domain expertise with strong process, technology, and analytical capabilities, it partners closely with regional and global teams to support corporate and investment banking, capital markets, and corporate services functions, while adhering to the highest standards of risk management, regulatory compliance, and control.

Mizuho Pune offers competitive compensation and benefits package aligned with industry standards and local market practices.

Mizuho Pune is an equal opportunity employer and is committed to fostering an inclusive and diverse workplace.

Employment is subject to applicable background verification checks in accordance with Indian laws and company policies.

https://www.mizuhogroup.com/asia-pacific/mizuho-global-services/careers

📌 Platform Engineering - Security Automation & SOAR Engineer (Pune)
🏢 Mizuho
📍 Pune