SOC Automation Engineer in Richmond Hill

We are looking for an automation expert to build complex SOAR playbooks, integrate AI into our workflows, and write Python/PowerShell scripts to reduce analyst fatigue. If you have a background in incident response and a passion for automation, check out the details below!

Key Responsibilities

• SOAR Development: Design, build, test, and maintain complex automation playbooks within our SOAR (Security Orchestration, Automation, and Response) platform to handle alert triage, containment, and remediation.
• Custom Scripting: Develop and maintain robust scripts using Python and PowerShell to automate routine SOC tasks, parse logs, and streamline daily operations, directly reducing analyst fatigue.
• AI Integration: Spearhead the adoption and safe integration of AI technologies and Large Language Models (LLMs) into our security workflows to assist with alert summarization, threat intelligence parsing, and automated decision-making.
• API Integrations: Build and manage custom API integrations between disparate security tools (SIEM, EDR, Firewalls, Threat Intel platforms) to ensure seamless data flow and orchestration.
• Process Engineering: Collaborate closely with Tier 1 and Tier 2 analysts to identify bottlenecks, manual pain points, and repetitive tasks that are prime candidates for automation.
• Metrics & Optimization: Track and report on the effectiveness of automations, focusing on measurable improvements to key SOC metrics like Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
• Incident Response Support: Leverage your background in alert handling and forensics to jump into high-severity incidents when necessary.

Required Qualifications

• Minimum 3 years of experience.
• Development Skills: Strong, proven proficiency in Python and PowerShell.
• Security Operations Experience: Hands-on experience working in a SOC environment, with a solid understanding of Incident Response (IR), alert handling, and basic digital forensics.
• SOAR Expertise: Proven experience developing playbooks and integrations in enterprise SOAR platforms (Experience with the Torq security automation platform is a strong advantage).
• API & Systems Knowledge: Deep understanding of RESTful APIs, JSON/XML parsing, webhooks, and how to securely interact with third-party applications.

This job operates in a professional office environment. This role routinely uses standard office equipment such as laptop computers, photocopiers, and smartphones.

Physical Demands: While performing the duties of this job, the employee is regularly required to talk or hear. Specific vision abilities required by this job include close vision and ability to adjust focus. This would require the ability to lift files, open filing cabinets, and bend or stand on a stool as necessary. The employee is occasionally required to stand; walk; use hands to finger, handle, or feel objects, tools, or controls; reach with hands and arms; and stoop, kneel, crouch or crawl. The employee may be required to lift up to 25 lb.

Position Type / Expected Hours of Work: This is a full-time position. Days and hours of work are Monday through Friday during normal business hours. Occasional evening and weekend work may be required as job duties demand.