Key Responsibilities

• Inventory every alert type from the EDR, NDR, identity threat detection, CASB, and enterprise browser platforms, including volume and historical disposition.

• Build a triage decision matrix with Cyber Defence defining enrichment, false positive criteria, escalation criteria, and severity, and document handoffs with our MSSP and EDR MDR provider.

• Build Tines integrations using the credential store and least-privilege service accounts.

• Develop reusable Tines components for enrichment, determination, native tool disposition, and Jira documentation.

• Build, test, and enable playbooks for all in-scope alert types, with error handling and failure alerting.

• Run playbooks in approval mode before enabling autonomous closure, and implement allowlists, audit logging, and a kill switch.

• Instrument metrics for volume, determinations, analyst overrides, time to triage, and playbook failures.

• Write runbooks for every playbook, deliver knowledge transfer, and provide an exit memo summarizing final automation coverage and disposition performance per source.

Required Qualifications

• Hands-on SOAR experience building and operating production stories, including credentials, sub-stories, HTTP and API actions, and error handling. Sanitized examples are required.

• Senior role in a SOC, or senior engineering support of a SOC, with a minimum of five years in security operations.

• Experience automating triage and enrichment for EDR and NDR alerts.

• Working knowledge of REST APIs, JSON, and webhooks.

Preferred Qualifications

• API experience with EDR, NDR, identity threat detection, CASB, or enterprise browser platforms, or with Jira.

• Experience working alongside an MSSP or MDR provider in a co-managed model.