Sr SOAR Engineer

Employment Type:

Full Time

Timing:

General

Work Mode:

NA

Experience:

7-10 years

Location:

Chennai

Key Responsibilities

• Inventory every alert type from the EDR, NDR, identity threat detection, CASB, and enterprise browser platforms, including volume and historical disposition.
• Build a triage decision matrix with Cyber Defence defining enrichment, false positive criteria, escalation criteria, and severity, and document handoffs with our MSSP and EDR MDR provider.
• Build Tines integrations using the credential store and least-privilege service accounts.
• Develop reusable Tines components for enrichment, determination, native tool disposition, and Jira documentation.
• Build, test, and enable playbooks for all in-scope alert types, with error handling and failure alerting.
• Run playbooks in approval mode before enabling autonomous closure, and implement allowlists, audit logging, and a kill switch.
• Instrument metrics for volume, determinations, analyst overrides, time to triage, and playbook failures.
• Write runbooks for every playbook, deliver knowledge transfer, and provide an exit memo summarizing final automation coverage and disposition performance per source.

Required Qualifications

• Hands-on SOAR experience building and operating production stories, including credentials, sub-stories, HTTP and API actions, and error handling. Sanitized examples are required.
• Senior role in a SOC, or senior engineering support of a SOC, with a minimum of five years in security operations.
• Experience automating triage and enrichment for EDR and NDR alerts.
• Working knowledge of REST APIs, JSON, and webhooks.

Preferred Qualifications

• API experience with EDR, NDR, identity threat detection, CASB, or enterprise browser platforms, or with Jira.
• Experience working alongside an MSSP or MDR provider in a co-managed model.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.