SOAR Engineer

Job description

Introduction
Information and Data are some of the most important organizational assets in today’s businesses. As a Security Consultant, you will be a key advisor for IBM’s clients, analyzing business requirements to design and implement the best security solutions for their needs. You will apply your technical skills to find the balance between enabling and securing the client's organization with the cognitive solutions that are making IBM the fastest growing enterprise security business in the world.

Your Role and Responsibilities
IBM Consulting Cybersecurity Services is seeking the role of SOAR Engineer for the automation and orchestration of cybersecurity incident response.
• Work on the SOAR platform to develop content for security automation (Playbooks, dashboards, etc.).
• Meet with security operation teams to identify areas or functions that can benefit from automation.
• Catalog and review any identified security automation use cases with stakeholders to facilitate prioritization with a focus on reducing cybersecurity risk through efficiency (i.e. time savings, improved response times and remediation).
• Develop automation roadmaps using out-of-the-box (or custom) integrations and features as described in the automation process design.
• Collaborate with SIEM engineering team and incident response as needed to support automation integrations and workflows for security personnel.
• Develop or update and optimize security automation metrics to highlight efficiency improvements.
• Manage the lifecycle of the SOAR platform, integrations and related components.
• Support, implement and promote standard configuration and change management, processes and practices.
• Document and maintain response Playbook information.

Required Technical and Professional Expertise
• Experience with Python or other automation languages.
• Experience with API integrations.
• Experience with SOAR tools such as Palo Alto XSOAR, IBM QRadar SOAR, etc.
• Management of development projects.
• Familiar with security operations centers and incident response work.
• Good verbal and written communication skills and problem-solving abilities.
• Desired certifications: CompTIA CySA+, Palo Alto XSOAR, IBM QRadar SOAR, Splunk SOAR.

Preferred Technical and Professional Expertise
NA