Sr Security Automation Engineer

Job Summary

The Senior Security Automation Engineer designs, builds, and operates the automation that lets Clearwaters security operations scale without scaling headcount at the same rate. This role owns the full lifecycle of automation development - from mapping a manual security workflow, to building the integration and logic that automates it, to monitoring that automation in production - across phishing triage, host isolation, user offboarding, alert enrichment, and ticket handling.

This is a builder role for someone who thinks like both a security practitioner and a software engineer: comfortable reasoning about incident-response logic and comfortable writing production-quality code that other engineers can maintain. The Senior Security Automation Engineer partners closely with SOC, Incident Response, and IT teams to find automation opportunities, and is expected to bring judgment about where automation - including AI-driven automation - helps versus where it introduces risk.

Responsibilities

• Workflow Orchestration: Design automated playbooks for common security scenarios (e.g., phishing triage, host isolation, user offboarding) using code or logic flows.
• API Integration: Build custom connectors to link disparate systems (e.g., SIEM, EDR, Ticketing Systems) via Rest/grpc APIs.
• ChatOps: Develop bots for internal collaboration platforms (e.g., Slack/Teams) to enable self-service security tasks.
• AI-Driven Triage: Implement Generative AI workflows to autonomously parse tickets, summarize alerts, and extract Indicators of Compromise (IoCs).

Must-Have Skills

• Scripting Coding: Strong proficiency in Python or Golang with a focus on API interaction and data processing.
• Integration Patterns: Expert understanding of Webhooks, RESTful design, and authentication methods (OIDC/OAuth/API Keys).
• Operational Logic: Experience with SOAR concepts (Logic Apps, Serverless Functions, or Workflow Engines) to automate decision trees.
• Security Context: Understanding of the Incident Response lifecycle and standard data formats (JSON, YAML).

Experience Required

• 5-10 years of combined experience in security engineering, security operations/incident response, or software engineering with a security focus.
• 2+ years specifically building security automation, SOAR playbooks, or equivalent orchestration solutions.
• Demonstrated experience integrating security tools (SIEM, EDR, ticketing/ITSM) via APIs in a production environment.

Qualifications, Skills, Knowledge

• Strong proficiency in Python or Golang, with a focus on API interaction and data processing.
• Expert understanding of integration patterns: webhooks, RESTful design, and authentication methods (OIDC/OAuth/API keys).
• Practical experience with SOAR concepts - logic apps, serverless functions, or workflow engines - to automate decision trees.
• Solid understanding of the incident-response lifecycle and standard data formats (JSON, YAML).
• Ability to reason about failure modes and edge cases in automated workflows, not just the happy path.
• Clear written communication - this role documents its own work so others can rely on it.
• Ability to Embrace Clearwaters Clear Core Values: Commitment to Client Success, Lead with Accountability, Integrity Collaboration, Excellence in All That We Do, Advance Colleague Success, and Respect Transparency

Professional Development Expectations

• Stay current on SOAR platforms, automation tooling, and applied generative-AI techniques relevant to security operations.
• Contribute reusable components, internal documentation, and lessons learned back to the automation practice.
• Mentor other engineers on secure coding and automation design as the team grows.
• Participate in relevant security engineering communities, conferences, or working groups to bring outside ideas back to the team.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.