SOC Automation Engineer

Job not on LinkedIn

🔥 12 hours ago

🇺🇸 United States – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🤖 QA Automation Engineer

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Ontinue

WebsiteLinkedInAll Job Openings

201 - 500 employees

💼 Consulting

🏥 Healthcare

📦 Logistics

Consulting • Healthcare • Logistics

Ontinue is a cybersecurity company that specializes in providing managed detection and response (MDR) services. Their AI-powered ION MXDR platform, combined with a 24/7 cyber defense center, delivers comprehensive security solutions tailored to individual organizational needs. Ontinue offers additional services such as managed vulnerability mitigation, IoT security, and incident response. They are particularly known for their expertise with Microsoft security solutions, offering consulting services to help clients maximize their Microsoft security capabilities. Ontinue serves multiple industries including financial services, healthcare, and high tech, and prides itself on its proactive, tailored, and transparent security approach.

📋 Description

• Design, develop and maintain Python-based automation workflows supporting security investigation, alert triage, enrichment, incident handling and response • Translate operational requirements and SOC analyst pain points into scalable automation use cases • Develop complex workflows using Temporal.io • Build integrations with security products, REST APIs, databases and internal and external systems • Create automation capabilities across alert triage, threat intelligence, investigation, enrichment and incident response • Work with Microsoft Sentinel, Microsoft Defender and Defender XDR, including associated telemetry and APIs • Develop and optimise Kusto Query Language (KQL) queries for investigation, enrichment, detection and automation • Design robust business logic for complex investigation scenarios and operational edge cases • Partner with Cyber Defenders to validate requirements and ensure automation delivers operational value • Contribute to requirements analysis, technical design, implementation, testing and continuous improvement • Monitor and improve automation performance, reliability, coverage and impact on analyst workload • Help shape Ontinue’s SOC automation architecture and engineering standards • Collaborate across SOC, Engineering, Product, AI and Platform teams

🎯 Requirements

• At least three years of professional experience in software engineering, cybersecurity, security operations or automation engineering • Hands-on software development experience, including coding, API integrations, data processing, error handling and asynchronous programming • Solid understanding of SOC operations, including alert triage, incident investigation, enrichment, threat intelligence and response • Experience with the Microsoft Security ecosystem, preferably including Microsoft Sentinel and Microsoft Defender • Strong KQL skills and ability to develop queries supporting security investigations and automation • Experience with Git and modern software development practices, including testing, debugging, code reviews and CI/CD • Understanding of distributed systems, asynchronous processing, workflow orchestration and scalable automation architectures • Experience developing automation for Microsoft Sentinel, Microsoft Defender for Endpoint, Defender XDR or associated Microsoft Security products • Experience developing production automation workflows, ideally using Temporal.io or comparable workflow orchestration frameworks • Experience integrating REST APIs and working with authentication, JSON, webhooks, external services, cybersecurity APIs or threat intelligence platforms • Knowledge of common attack techniques and frameworks, including MITRE ATT&CK

🏖️ Benefits

• Remote work arrangement • Full-time employment