SOAR Automation Engineer

Role Description
Information Security Engineer Role
Overview
We are seeking a talented and experienced Security Engineer with a strong focus on Python and security automation to join our Information Security team. The ideal candidate will be adept at developing and implementing automated security solutions to protect our systems and data, as well as reviewing, validating, and hardening code and workflows produced by AI coding assistants (e.g., Claude, GitHub Copilot) and agentic systems. This role requires a proactive individual who can work independently and collaboratively to enhance our security posture in an environment where both humans and AI agents write and operate code. In addition, proficiency and experience using a SOAR for automation and security incident response is required.
Key Responsibilities
Develop, implement, and maintain security automation scripts and tools using Python to a high standard of reliability and efficiency, including reviewing and hardening code generated by AI coding assistants.
Integrate security tools and solutions, including developing and managing APIs, to automate security processes and workflows.
Conduct security assessments and vulnerability analysis to identify and mitigate potential threats.
Monitor security systems and respond to incidents with automated solutions, implementing and managing SOAR platforms (e.g., Palo Alto Cortex XSOAR, Tines, Splunk Phantom, IBM Resilient, Cyware, Microsoft Logic Apps, ThreatConnect) to streamline response activities.
Collaborate with cross-functional teams to design and implement security controls, and write clear technical documentation (SOPs, write-ups, user guides) for tools and processes.
Govern enterprise use of AI coding assistants and agentic tools (e.g., Claude Code, Codex, GitHub Copilot, Cursor), including tenant restrictions, access scoping, and compliance/audit logging.
Design and enforce security controls for agentic AI systems, including tool-permission boundaries, prompt injection defenses, and agent identity/access governance.
Utilise Microsoft Defender for Endpoint (MDE) for threat detection and Kusto Query Language (KQL) to analyse security data.
Implement CI/CD pipeline automation and Infrastructure as Code (IaC) tools (e.g., Terraform, Ansible) to ensure secure code deployment and infrastructure provisioning.
Skills And Experience Required
Bachelor’s degree in computer science, Information Security, or a related field.
Proven experience as a Security Engineer or in a similar role, with a focus on Python and security automation.
Strong programming skills in Python, with experience developing automation scripts and tools, as well as reviewing and validating code generated by AI coding assistants.
Experience with security tools and technologies such as SIEM, IDS/IPS, firewalls, and vulnerability scanners.
Knowledge of cloud security (AWS, Azure, GCP) and container security (Docker, Kubernetes).
Experience with API development and integration, including RESTful APIs.
Proficiency in implementing and managing SOAR platforms (e.g., Palo Alto Cortex XSOAR, Splunk Phantom, IBM Resilient, Cyware, Microsoft Logic Apps, ThreatConnect).
Hands-on experience with Microsoft Defender for Endpoint (MDE) for endpoint security.
Excellent problem-solving skills and attention to detail, with strong written and verbal communication, including writing technical documentation (SOPs, write-ups, user guides) for technical and non-technical stakeholders.
Experience securing AI/LLM-based agentic systems, including prompt injection defense, tool-permission boundaries, and agent identity governance.
Experience governing enterprise AI coding assistants (e.g., Claude Code, Codex, GitHub Copilot), including compliance/audit logging, tenant restrictions, and CI/CD supply-chain hardening against AI-related risks.
Desirable
Proficiency in Kusto Query Language (KQL) for querying and analysing security data.
Relevant certifications such as CISSP, CEH, OSCP, or GIAC.
Experience with DevSecOps practices and CI/CD tools (e.g., Jenkins, GitLab CI/CD).
Understanding of network protocols and security architecture.
Familiarity with the OWASP Agentic AI Top 10 (e.g., tool misuse, agentic supply-chain risk, unexpected code execution, human-agent trust exploitation).
Experience with AI red-teaming and evaluation methodologies for agentic and LLM-based systems.
Understanding of Model Context Protocol (MCP) security and other agent-tool integration risks.
Skills
AI Security, Python, Cloud Security, IDS/IPS, LLMs, Vulnerability Assessment, SOAR, Container Security, Microsoft Defender for Endpoint

Work arrangement
No