About the role
You will join our Cybersecurity Automation team to eliminate repetitive tasks, accelerate incident response, and measurably reduce risk. You will be the hands-on expert designing, developing, and operating automations on SOAR low-code/no-code platforms such as Tines, Torq, and n8n, optimizing detection and response workflows, and enabling seamless integration between security systems.
What you'll do
- Design and build automation workflows (playbooks) in Tines, Torq, and n8n to enrich alerts, perform triage, notifications, containment, and post-incident tasks (e.g., block indicators, disable accounts, isolate endpoints).
- Integrate security tools and ecosystems: EDR/XDR, firewalls, threat intelligence feeds, cloud platforms, identity stores, messaging (Teams/Slack), and evidence repositories.
- Ensure reliability of automations: robust error handling, retries, health checks, observability (logs/metrics), and secure secrets management.
- Improve detection-to-response flow: enrich alerts, reduce false positives, and streamline handoffs between SIEM, SOAR, and ticketing systems (ServiceNow, Jira, etc.).
- Governance and SDLC: version control (Git), code reviews, CI/CD, change management, documentation, and runbook creation.
- Enable the SOC: create reusable automation building blocks, document playbooks, and train analysts for safe operation.