Cybersecurity Automation Engineer

Build security automation and integrations that connect SIEM and enterprise platforms to strengthen security operations at speed.

Responsibilities

• Design, build, and maintain automation workflows across SIEM, SOAR, endpoint security, identity, vulnerability management, cloud, and ticketing platforms
• Develop integrations using REST APIs, web-hooks, SDKs, and scripting languages such as Python and PowerShell
• Automate alert enrichment, investigation support, case creation, evidence collection, notifications, and incident response actions
• Engineer cross-platform correlation workflows to improve visibility, reduce manual effort, and enable faster security decisions
• Collaborate with security analysts and incident responders to identify automation opportunities and translate operational playbooks into technical workflows
• Automate vulnerability management tasks including asset enrichment, remediation ticket creation, ownership assignment, escalation, and closure validation
• Build safeguards into automated actions, including approval requirements, access restrictions, validation checks, and rollback procedures
• Implement secure integration practices, including authentication, secrets management, least-privilege access, and audit logging for integrations and service accounts
• Maintain automation code through version control, peer review, testing, documentation, and established change management processes
• Monitor automation health, troubleshoot failures, and handle API limits, platform changes, retries, and exception handling
• Document integration architectures, data flows, dependencies, operating procedures, and troubleshooting guidance
• Measure automation effectiveness using time saved, execution reliability, reduced manual handling, and improved response times
• Support security control implementation and audit readiness by automating evidence collection and reporting
• Identify and implement opportunities to apply AI to enhance security automation (alert enrichment, investigation summaries, incident prioritization, and response recommendations)
• Integrate AI capabilities into security workflows with human oversight, data protection, output validation, and audit logging
• Evaluate AI-assisted workflows for accuracy, reliability, and measurable improvements in analyst efficiency and response time

Requirements

• 3+ years of experience in security engineering, security automation, software development, or a related technical discipline
• Experience developing and maintaining automation solutions using Python, PowerShell, or comparable languages
• Practical experience integrating enterprise platforms via APIs, including authentication, JSON data handling, pagination, and error handling
• Working knowledge of security operations, incident response processes, and common endpoint, identity, network, and cloud threats
• Experience with SIEM or SOAR platforms and workflow orchestration tools
• Familiarity with Git, code review, testing, and secure development practices
• Ability to troubleshoot complex workflows and dependencies across multiple systems
• Strong written and verbal communication skills, including explaining technical solutions to nontechnical stakeholders
• Ability to prioritize work, manage competing requirements, and independently deliver maintainable solutions
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience

Technologies

• SIEM, SOAR, REST APIs, web-hooks, SDKs
• Python, PowerShell, Git, JSON
• Azure Logic Apps, Azure Functions
• Microsoft Intune, Palo Alto Networks, Jira, KQL
• CI/CD pipelines, infrastructure as code
• NIST incident response guidance, MITRE ATT&CK, CMMC, NIST SP 800-171
• Large language models (LLMs), AI-enabled security tools
• Azure Government, Microsoft GCC High

Benefits

• Medical, dental, vision
• 401K with company matching
• 9/80 work schedule
• Paid holiday shutdown

Other Qualifications & Desired Competencies

• Experience with Microsoft security technologies, Azure Logic Apps, Azure Functions, Microsoft Intune, Palo Alto Networks, or Jira
• Experience integrating AI capabilities, large language models (LLMs), or AI-enabled security tools into automation workflows, including understanding limitations and secure use
• Experience supporting Azure Government, Microsoft GCC High, or other regulated enterprise environments
• Familiarity with KQL, cloud automation, CI/CD pipelines, and infrastructure as code
• Experience implementing automated response actions with human approval and operational safeguards
• Familiarity with NIST incident response guidance, MITRE ATT&CK, CMMC, and NIST SP 800-171

Physical Demands

• Ability to work in an office environment (Constant)
• Required to sit and stand for long periods; talk, hear, and use hands and fingers to operate a computer and telephone keyboard (Frequent)

Clearance Level

• No Clearance

Salary Range

• USD 111,500 - 170,000 per yearly

ITAR Requirement

• Position requires access to information subject to compliance with the International Traffic Arms Regulations (ITAR) and/or the Export Administration Regulations (EAR)
• Applicants must qualify as a U.S. person under ITAR/EAR, or be approved for an export license by the governing agency
• U.S. person definition includes U.S. citizen, U.S. lawful permanent resident (green card holder), or protected individual such as refugee or asylee
• Some positions may require current U.S. Citizenship due to contract requirements

Location: Huntsville, AL (onsite)

Schedule: 9/80