XSOAR Engineer (Implementation & Deployment)

Role Overview

Design, Deploy, configure, and operationalize Palo Alto Cortex Security Orchestration, Automation, and Response (XSOAR) , implementing automation playbooks, integrations, and incident workflows to support the Security Operations Centre (SOC).

Key Responsibilities

• Design XSOAR architecture and deployment model (multi-tenant, scalable)
• Deploy and configure Cortex XSOAR platform components
• Define multi-tenant architecture :
• Tenant separation
• Playbook isolation
• Role-Based Access Control (RBAC) model
• Define high availability (HA), disaster recovery (DR), and backup strategies
• Implement incident ingestion from SIEM into XSOAR
• Build and maintain automation playbooks :
• Phishing response
• Suspicious login
• Malware alerts
• ETC
• Configure and maintain integrations with:
• Elastic SIEM
• Endpoint Detection and Response (EDR) tools
• Firewalls and network tools
• Identity and Access Management (IAM) systems
• Ticketing platforms (ServiceNow, Jira, BMC Remedy)
• Implement Role-Based Access Control (RBAC) and tenant separation
• Configure incident types, fields, layouts, and workflows (SecIM)
• Perform testing and validation of playbooks and integrations
• Troubleshoot:
• Integration failures
• Playbook errors
• API connectivity issues
• Support platform monitoring, upgrades, and maintenance
• Assist with automation scripting (Python, APIs)
• Support deployment automation and configuration management
• Work closely with Architects and SOC teams to refine workflows

Required Skills

• Strong experience with Palo Alto Cortex XSOAR architecture
• Hands-on experience with Palo Alto Cortex XSOAR
• Experience building automation playbooks and integrations
• Strong knowledge of application programming interfaces (APIs)
• Scripting experience ( Python preferred )
• Understanding of incident response workflows
• Experience with Linux systems and troubleshooting

Ideal Candidate Experience

• 3–7+ years in Security Operations, Incident Response, or Security Engineering
• 2–4+ years hands-on experience with Cortex XSOAR
• Experience implementing playbooks and automation in production SOC environments
• Experience integrating SIEM, EDR, identity, and ticketing tools
• Familiarity with:
• Continuous Integration and Continuous Deployment (CI/CD) pipelines
• Infrastructure as Code (IaC) (nice to have)
• Experience in large-scale or enterprise environments
• Exposure to regulated environments (government, telecom, finance) is a plus

Clearance Requirement

• Active Government of Canada Secret Clearance is mandatory