SOAR Engineer

About Sekuro
We're a founder-led global consulting company in the cybersecurity market, operating across Australia, Asia, and the UK. Our reputation is built on breaking away from traditional consulting models, embracing a direct and fresh approach that puts clients at the centre of everything we do. Our mission is simple: to be our clients' most trusted security partner by delivering impactful outcomes that build resilience, enable innovation, and improve competitiveness.
Our vision is to be the world's most trusted security partner, enabling organisations to protect today and prepare for tomorrow. We exist to secure organisations, empowering them to thrive in a digital world.
We live by our values: we are brave, we raise the bar, we tell it how it is, we own the outcome, and we care for all.
The Role
Sekuro is looking for a SOAR Engineer to join the Cloud Security team within our Global Managed Security Services Engineering group. You'll own the security automation behind our round-the-clock SOC, building, operating and improving the workflows that enrich, triage and respond to security alerts.
We treat automation as software, not scripts. Workflows live in Git, ship through pull requests and CI, and run against production APIs at scale. You'll take over an existing Swimlane Turbine implementation, make the call on what to keep, rebuild or retire, and help shape our move towards CrowdStrike Falcon Fusion SOAR and our AI-assisted triage platform.
What You'll Do
You'll design, build and operate SOAR workflows in Swimlane Turbine, CrowdStrike Falcon Fusion and n8n, for internal analysts and external clients alike. Every bit of automation will be managed as code, with workflows, integrations and configuration held in GitHub Enterprise and released through pull requests, peer review and CI pipelines. No hand edits in production, ever.
You'll build response actions with an analyst approval step, such as approval via Microsoft Teams, covering host containment, user containment and email removal, with every decision properly recorded. You'll make every workflow observable and resilient, with retries and backoff on API rate limits, idempotent reruns, clean handling of partial failures, and alerting when automation breaks before an analyst even notices.
You'll get hands-on across our broader security stack, integrating SOAR with SIEM platforms like CrowdStrike Next-Gen SIEM, LogScale, Microsoft Sentinel and Splunk, as well as EDR, Jira Service Management, identity platforms such as Entra ID and Okta, and email security tools, using REST APIs, webhooks and SDKs.
AI will be part of your everyday toolkit. You'll use tools like Claude Code to read, write, test and refactor automation, applying smart guardrails along the way. You'll also assess our existing brownfield automation and make clear, reasoned calls on what to keep, rebuild or retire as we consolidate platforms.
You'll partner closely with Detection Engineering, so filtering and suppression logic sits at the detection layer, leaving SOAR free to focus on enrichment, decisions and response. And rather than building one-off playbooks per client, you'll create reusable, multi-client patterns with client-specific configuration.
Finally, you'll produce run-books and documentation, present automation outcomes to client stakeholders, and contribute effort estimates to statements of work.
What You'll Need
You'll bring at least two years of experience building and running SOAR or security automation in production, whether in a SOC, MSSP, incident response or security engineering role
You've got hands-on experience with at least one SOAR or workflow platform, such as Swimlane, Falcon Fusion, Splunk SOAR, Palo Alto XSOAR, Sentinel playbooks (Logic Apps), Tines or n8n.
Strong Python skills are a must, along with a solid grasp of RESTful APIs, JSON, webhooks and authentication methods including OAuth 2.0 client credentials and scoped API keys. You use Git day-to-day, with pull-request review and CI pipelines like GitHub Actions, for automation or code you own.
You've automated at least one response action, such as host isolation, account disable or email removal, and understand how it's approved, recorded and rolled back. You're comfortable handling API rate limits, retries, idempotency and failure alerting in automated workflows, and you use AI-assisted development tools regularly in your own engineering work, with a clear view on how to review and constrain their output.
You're also familiar with SIEM pipelines and the alert lifecycle, and you can communicate clearly with clients and non-technical audiences.
It would be great, though not essential, if you also had Swimlane Turbine or CrowdStrike Falcon Fusion development experience, or familiarity with FalconPy and the CrowdStrike APIs.
Experience operating automation across multiple clients or tenants in a managed service is a bonus, as is exposure to infrastructure as code such as Pulumi or Terraform, containers and Kubernetes, and GitOps deployment with Argo CD. Cloud security experience across AWS and Azure, and certifications such as GCIH, SSCP or vendor SOAR certifications, would round things out nicely.
Above all, you've got an engineering mindset. You treat automation as production software that's tested, reviewed, versioned and monitored. You've got the judgement to automate response actions safely, knowing where a human must approve and how to make that approval fast for analysts. You move with pace, shipping small, safe changes quickly and validating them in days, not months. And you're curious about AI and new tooling, with just the right amount of scepticism to check what it produces, backed by a collaborative, accountable approach to working with analysts, engineers and clients.
Any questions? Give Tim Smith a call on 0425814791.

Work arrangement
Yes