Lead Security Automation Consultant – SOAR, Azure

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, and implement security automation workflows tailored to specific client use cases.

• Create integrations between security platforms, ServiceNow, and various enterprise applications utilizing REST APIs and Microsoft Graph.

• Develop and maintain Azure Functions using Python.

• Construct and utilize KQL queries, especially for Microsoft Defender advanced hunting, to extract, filter, and analyze security data.

• Create automated workflows with Tines or similar security orchestration and automation platforms.

• Integrate security alerts, incident data, and case-handling processes with ServiceNow.

• Leverage Microsoft Entra ID for identity-related automation, including modifications to group memberships and application registration credentials.

• Implement Azure DevOps pipelines for deploying Azure Functions and support controlled release processes.

• Adhere to client change-control and approval protocols.

• Diagnose, test, and enhance automation workflows and integrations.

• Develop reusable components, create supporting runbooks, and conduct knowledge-transfer sessions.

• Collaborate with client stakeholders to comprehend requirements and convert them into effective automation solutions.

⛳️ Requirements

• Must reside in the United States.

• Must be authorized to work in the United States without sponsorship, either currently or in the future.

• Must successfully pass a background check.

• A minimum of 5 years of experience in security engineering, security automation, systems integration, or a related technical field.

• Practical experience in designing and implementing security automation or workflow automation solutions.

• Strong proficiency in Python development, including the creation and deployment of Azure Functions.

• Experience in writing and utilizing Kusto Query Language (KQL), particularly with Microsoft Defender advanced hunting.

• Proven track record of integrating ServiceNow with security platforms or other enterprise applications.

• Extensive experience in building and consuming REST APIs and developing application integrations.

• Familiarity with Microsoft Graph and Microsoft Entra ID, particularly in automating group membership updates and handling application registration credentials.

• Experience in implementing Azure DevOps pipelines for Azure Functions deployment.

• Experience navigating structured change-control and approval processes.

• Knowledge of a security orchestration or workflow automation platform such as Tines, Torq, Swimlane, Splunk SOAR, Cortex XSOAR, or Microsoft Sentinel Playbooks/Azure Logic Apps.

• Ability to independently develop, troubleshoot, and deliver functional automation solutions within a set project timeline.

• Strong problem-solving, communication, documentation, and knowledge-sharing abilities.

• Direct, hands-on experience with Tines is preferred.

• Familiarity with Microsoft Sentinel and its playbooks is preferred.

• Experience with Defender for Office 365 or Proofpoint email and click data is preferred.

• Knowledge of Tenable and Common Vulnerabilities and Exposures (CVE) data is preferred.

• Experience with the Hunters security platform is preferred.

• Familiarity with n8n, Power Automate, Workato, or other workflow automation platforms is preferred.

• Experience in developing security triage, ticketing, and case-management workflows is preferred.

• Previous experience in a consulting or professional services environment is preferred.

🏝️ Benefits

• Work remotely from anywhere in the United States with flexible working hours.

• Sponsored and supported learning opportunities.

• A culture that promotes Great Place to Work® Certification.

• Short-term 1099 contract engagement.