We are hiring Cortex XSOAR Engineers (Playbook & Integration Developers) for a leading global professional services firm at its Mumbai and Hyderabad offices. This is a hands-on SOAR ENGINEERING / DEVELOPMENT role - not SOC monitoring or L1/L2 alert triage.

Open levels and budget (fixed CTC):

- Consultant: 1.5 - 3 years, up to Rs 9 LPA

- Assistant Manager: 3.1 - 6 years, up to Rs 13 LPA

- Deputy Manager: 6.1 - 9 years, up to Rs 17 LPA

Location: Mumbai (incl. Thane / Navi Mumbai) or Hyderabad - candidates currently based in these cities only.

Notice period: Immediate to 60 days (immediate joiners preferred).

Interview: Face-to-face / Video interview drive on Saturday, 10 October 2026.

Role & responsibilities:

- Design, develop, test and maintain Cortex XSOAR / XSIAM playbooks for incident response use cases (phishing, malware, EDR alerts, account compromise, vulnerability response, threat-intel enrichment, etc.)

- Build custom integrations, automations and scripts in Python (and JavaScript where needed) using REST APIs, JSON, webhooks and the XSOAR SDK / demisto-sdk

- Integrate SIEM (QRadar, Splunk, Sentinel, XSIAM), EDR/XDR (Cortex XDR, CrowdStrike, Defender), ITSM (ServiceNow, Jira), email, firewall, IAM and threat-intel platforms with XSOAR

- Translate SOC use-case documents into automated workflows; create incident types, layouts, fields,



classifiers and mappers

- Deploy, configure, upgrade and administer XSOAR (standalone / multi-tenant, engines, content packs, marketplace)

- Troubleshoot playbook and integration failures, optimise performance and document HLD / LLD and runbooks

- Work with clients and SOC teams to gather requirements; for AM / DM levels, lead delivery, review code and mentor juniors

Preferred candidate profile:

- Hands-on Cortex XSOAR (Demisto) or XSIAM playbook development experience is a must

- Strong Python scripting and REST API integration skills

- Good understanding of SOC processes, incident response and security tools (SIEM, EDR, email security, TI)

- Certifications such as PCSAE (Palo Alto Certified Security Automation Engineer), PCDRA, SC-200 or Splunk SOAR are a plus

- Good communication skills; consulting / client-facing exposure preferred for AM / DM

- Stable career history preferred (no job change in the last 12 months)

Why join:

- Work with a leading global professional services firm on large enterprise security automation programmes

- Exposure to multiple clients, the latest Palo Alto Cortex platforms and structured growth opportunities

To apply: please answer all screening questions and keep your current CTC, expected CTC and notice period updated.

📌 Cortex XSOAR Engineer - Playbook & Integration Developer (Hyderabad)
🏢 WSNE Consulting
📍 Hyderabad