Security Consultant - Xsoar L2

Job description

Your Role and Responsibilities: We are seeking a skilled engineer to design, develop, and maintain playbooks and integrations within Cortex XSOAR. You will bridge the gap between security operations and software development, translating incident response workflows into efficient, automated code. You will work closely with threat hunters, SOC analysts, and IT teams to identify repetitive tasks and build resilient automations. Key Responsibilities • Playbook Development: Design, code, test, and debug complex incident response playbooks in Cortex XSOAR using Python and the platforms visual playbook editor. • Integration Management: Develop and maintain custom integrations with third-party security tools (EDR, SIEM, Firewalls, Ticketing Systems, Threat Intel Platforms) using the Cortex XSOAR API and Python. • Content Management: Manage the full lifecycle of XSOAR content (Playbooks, Integrations, Scripts, Classifiers, Mappers, Dashboards) using version control systems like Git. • Incident Response Enhancement: Collaborate with SOC analysts to understand pain points in current IR processes and translate requirements into automated solutions to reduce manual intervention. • Maintenance & Troubleshooting: Monitor the health of the XSOAR environment, troubleshoot failed automations, and optimize performance and API usage. • Documentation: Maintain thorough documentation of playbooks, integrations, and standard operating procedures (SOPs). Required Education: Bachelor's Degree Preferred education Master's Degree Required Technical and Professional Expertise: • Experience: [4+] years of experience in Security Engineering, DevOps, or Software Engineering, with at least [3+] years specifically working with Palo Alto Networks Cortex XSOAR. • Programming: Strong proficiency in Python (essential for custom scripts and integrations). Experience with JavaScript or PowerShell is a plus. • XSOAR Proficiency: Deep understanding of Cortex XSOAR architecture, including Incident Types, Layouts, Fields, Classifiers, Mappers, and the core automation engine. • APIs & Integrations: Proven experience consuming RESTful APIs to connect disparate security tools. Ability to troubleshoot API authentication and data parsing issues. • Security Domain Knowledge: Solid understanding of the Incident Response lifecycle, common attack vectors (MITRE ATT&CK), and security technologies (SIEM, EDR, SOAR, TIP). • Problem Solving: Excellent analytical skills with the ability to debug complex, distributed system issues. Preferred Technical and Professional Experience: • Cortex XSOAR Certification • SIEM Experience: Familiarity with SIEM platforms such as XSIAM, Splunk, QRadar, or Microsoft Sentinel. **Years of Experience:** 3 - 6