Incident response Automation engineer

Job Summary

We are seeking an experienced AI Incident Response Automation Engineer to design, develop, and implement AI-driven security incident detection, investigation, triage, and response automation solutions. The ideal candidate will have strong expertise in cybersecurity operations, Security Orchestration, Automation and Response (SOAR), SIEM platforms, scripting, and AI/ML technologies.

The candidate will leverage AI, Generative AI, and automation frameworks to accelerate incident investigations, reduce manual security operations, improve threat detection accuracy, and enable faster remediation of cyber threats across enterprise environments.

Key Responsibilities

• Design and implement AI-powered security incident response and automation workflows.

• Develop automated playbooks for security alert triage, enrichment, investigation, containment, and remediation.

• Integrate AI/ML and Generative AI capabilities into existing SOC and incident response processes.

• Build and maintain SOAR workflows to automate repetitive security operations tasks.

• Integrate SIEM, EDR/XDR, threat intelligence, identity security, and cloud security platforms.

• Develop AI-assisted incident investigation workflows using LLMs, natural language processing, and security analytics.

• Automate incident prioritization, severity classification, alert correlation, and false-positive reduction.

• Develop scripts and integrations using Python, REST APIs, PowerShell, or Bash.

• Implement automated containment actions, including endpoint isolation, account disabling, and malicious IP blocking, with appropriate approval controls.

• Analyze security events, endpoint telemetry, threat intelligence, and attack patterns to improve response workflows.

• Implement human-in-the-loop validation, audit logging, and safeguards for AI-generated recommendations and response actions.

• Measure and improve incident response metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

• Collaborate with SOC analysts, threat hunters, security engineers, and incident response teams to improve security operations.

• Document automation workflows, incident response procedures, integrations, and operational standards.

Required Skills

• 5+ years of experience in cybersecurity, security engineering, incident response, or security automation.

• Hands-on experience with SIEM, SOAR, and security incident response processes.

• Experience developing automated security workflows, playbooks, and API-based integrations.

• Strong Python scripting skills and experience with REST APIs and JSON.

• Knowledge of AI/ML, Generative AI, LLMs, prompt engineering, and AI-assisted security operations.

• Experience with security platforms such as:

  • Splunk Enterprise Security and Splunk SOAR

  • Palo Alto Cortex XSOAR / XSIAM

  • Microsoft Sentinel and Logic Apps

  • IBM QRadar and security automation solutions

• Strong understanding of incident response lifecycle, threat intelligence, malware analysis, and threat hunting.

• Experience integrating EDR/XDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.

• Understanding of MITRE ATT&CK, common attack techniques, and security operations best practices.

• Knowledge of authentication, identity security, cloud security, and enterprise network security