Cortex XSOAR Engineer - Playbook & Integration Developer

Role & responsibilities

Preferred candidate profile

We are hiring Cortex XSOAR Engineers (Playbook & Integration Developers) for a leading global professional services firm at its Mumbai and Hyderabad offices. This is a hands-on SOAR ENGINEERING / DEVELOPMENT role - not SOC monitoring or L1/L2 alert triage.

Open levels and budget (fixed CTC):

• Consultant: 1.5 - 3 years, up to Rs 9 LPA

• Assistant Manager: 3.1 - 6 years, up to Rs 13 LPA

• Deputy Manager: 6.1 - 9 years, up to Rs 17 LPA

Location: Mumbai (incl. Thane / Navi Mumbai) or Hyderabad - candidates currently based in these cities only.

Notice period: Immediate to 60 days (immediate joiners preferred).

Interview: Face-to-face / Video interview drive on Saturday, 10 October 2026.

Role & responsibilities:

• Design, develop, test and maintain Cortex XSOAR / XSIAM playbooks for incident response use cases (phishing, malware, EDR alerts, account compromise, vulnerability response, threat-intel enrichment, etc.)

• Build custom integrations, automations and scripts in Python (and JavaScript where needed) using REST APIs, JSON, webhooks and the XSOAR SDK / demisto-sdk

• Integrate SIEM (QRadar, Splunk, Sentinel, XSIAM), EDR/XDR (Cortex XDR, CrowdStrike, Defender), ITSM (ServiceNow, Jira), email, firewall, IAM and threat-intel platforms with XSOAR

• Translate SOC use-case documents into automated workflows; create incident types, layouts, fields, classifiers and mappers

• Deploy, configure, upgrade and administer XSOAR (standalone / multi-tenant, engines, content packs, marketplace)

• Troubleshoot playbook and integration failures, optimise performance and document HLD / LLD and runbooks

• Work with clients and SOC teams to gather requirements; for AM / DM levels, lead delivery, review code and mentor juniors

Preferred candidate profile:

• Hands-on Cortex XSOAR (Demisto) or XSIAM playbook development experience is a must

• Strong Python scripting and REST API integration skills

• Good understanding of SOC processes, incident response and security tools (SIEM, EDR, email security, TI)

• Certifications such as PCSAE (Palo Alto Certified Security Automation Engineer), PCDRA, SC-200 or Splunk SOAR are a plus

• Good communication skills; consulting / client-facing exposure preferred for AM / DM

• Stable career history preferred (no job change in the last 12 months)

Why join:

• Work with a leading global professional services firm on large enterprise security automation programmes

• Exposure to multiple clients, the latest Palo Alto Cortex platforms and structured career growth

To apply: please answer all screening questions and keep your current CTC, expected CTC and notice period updated.