Cybersecurity Automation Engineer

Technology

Compensation Overview

The annual base salary range provided for this position is a nationwide market range and represents a broad range of salaries for this role across the country. The actual salary for this position will be determined by a number of factors, including the scope, complexity and location of the role; the skills, education, training, credentials and experience of the candidate; and other conditions of employment. As part of our comprehensive compensation and benefits program, employees are also eligible for performance-based cash incentive awards.

Salary Range

$91,800.00 - $151,600.00

1

The Cybersecurity Automation Engineer is responsible for designing, building, and maintaining automation and associated platforms in support of our 24x7x365 Security Operations Center (SOC). This is a technical, on-call position that works with a skilled cybersecurity team to help protect enterprise resources. They will be a developer, creating and maintaining scripts, automation, and cloud infrastructure in our Security Orchestration, Automation and Response (SOAR) team. You must be willing to work in a 24x7x365 team environment and be on-call during certain times, meaning you will be prepared to work evening and late-night schedules as required to perform incident response actions.

The ideal candidate will bring a background/experience as a provide developer or equivalent experience in scripting, preferably in a hands-on Cybersecurity role. Key components are being a self-starter, be a good communicator, have an aptitude for learning, designing resilient automation, and can critically (and creatively) think through problems. Self-motivation and a desire to learn are key characteristics that will lead to success in this role.

This role will directly support the continuous maturation of our Security Orchestration, Automation and Response (SOAR) framework via the development of automated security workflows. The ideal candidate will bring experience in either programming or scripting, and administering cloud (AWS, Azure, GCP) environments. Working experience with APIs, CI/CD pipelines, and version control systems are key aspects of this role.

What Will You Do?

• Work in a 24x7x365 environment, have a team-centric focus, and be prepared to work evening and late-night schedules as required to perform sufficient incident response actions.
• Able and willing to triage, develop, and support automation to maintain 24x7x365 availability.
• Develop, test, document, and implement automation logic and scripts.
• Develop, test, document, and implement workflows in low-code environments.
• Observes and recommends changes to processes and technologies, including automation.
• Provide training and demoing of automation to the end user and SOC, as well as solicit feedback for improvements from end users and SOC management.
• As part of onboarding and ongoing automation responsibilities, this role will assist in identifying anomalies, malware, exploit attempts, and other attacks using the Security Information and Event Management (SIEM) and SOAR platforms. Monitor automation environment and perform breakfix response via SIEM and SOAR platforms.
• Creates and maintains standard operating procedures (SOPs) and other documentation including operating instructions and knowledge transfer articles.
• May participate in SOC investigations to determine root cause of events and understand the role that automation played in the events.
• Function as a security representative at design and technology design and configuration meetings.
• May provide guidance to more junior employees.
• Perform other duties as assigned.

What Will Our Ideal Candidate Have?

• Bachelor’s Degree in a STEM (Science, Technology, Engineering, Math) discipline preferred.
• Three years of relevant experience with Cybersecurity practices, processes, and Cybersecurity event investigation/resolution preferred.
• Experience in some discipline of data analysis and root cause analysis.
• Experience developing or scripting with Python required.
• Experience deploying and administering AWS infrastructure required.
• Familiarity with API architecture, and direct experience with API scripting outputs via Python/curl for integration with disparate systems is highly preferred.
• Experience with CI/CD and deployment pipelines, including GitHub actions, is preferred.
• Experience with terminal/scripting programs (PowerShell, shell (bash), etc.) is helpful.
• Experience with other programming languages (Go, Java, JavaScript, etc.) is helpful.
• Understanding of security concepts, best practices, and emerging trends is helpful.
• Proven problem-solving skills including debugging skills, allowing you to determine source of issues in unfamiliar code or systems and the ability to recognize and solve repetitive problems.
• Experience working in, or usable knowledge of, operations-focus team responsible for maintaining 24x7x365 availability.
• Knowledge of cybersecurity methodologies, processes, and a conceptual understanding of other cybersecurity procedures and policies is preferred.
• Problem Solving:
  • Ability to recognize and analyze problems of average complexity and independently consider a variety of alternatives to arrive at a timely, practical, and effective solution.
  • Ability to critically think through problems, and independently determine severity and sensitivity of various cybersecurity events.
• Communication:
  • An active participant in team standups, knowledge shares, and other sessions.
  • Proactively communicates status and anticipated problems.
  • Keeps team aware of status while monitoring (in relation to incident response activities).
  • Comfortable reaching out to coworkers and/or leads when progress is blocked.
• Team Orientation:
  • Holds self and others accountable.
  • Flexible when selecting on-call rotations.
  • Builds relationships with teammates.
  • Works to build relationships with other departments and stakeholders.
  • Balances team and individual responsibilities.
  • Exhibits objectivity and openness to others’ views.
  • Gives and welcomes feedback with both teammates and management.
  • Demonstrates the willingness to live out the values out service before self, integrity first, excellence in all we do.
• Leadership:
  • Accountable for all tasks delegated by the supervisor.
  • Aptitude for managing own workload.
  • Seeks opportunity to lead, even as an individual contributor.
• Planning and Project Management:
  • Able to sets appropriate goals and priorities and modify those based on team needs.
  • Ability to balance multiple tasks of competing priority on-time and with reasonable quality.
• Provides management with accurate and timely status information

What is a Must Have?

• High school diploma or equivalent required.
• Three years of work experience within Computer Science or a related field required.