Security Automation Engineer (SOAR/XSOAR) | Davinsi Labs

Editx; Sint-Agatha-Berchem; On-site; EUR 65,000 - 85,000; Full time

Job summary

Editx is seeking a Security Automation Engineer in Sint-Agatha-Berchem, Belgium to design and maintain automated response capabilities using Palo Alto Cortex XSOAR. You will translate detection signals into reliable response workflows, significantly enhancing security incident handling.

This role involves developing playbooks, managing integrations, and collaborating with various teams to improve automated responses. Strong experience in SIEM, XDR platforms, and software engineering practices is essential for success.

Qualifications

• Experience in designing and maintaining automated response workflows.
• Familiarity with SIEM and XDR platforms.
• Knowledge of integration and optimization of security tools.

Responsibilities

• Design, build, and maintain response playbooks in Cortex XSOAR.
• Translate detection alerts into automated investigation and response flows.
• Collaborate with teams to define automated investigation steps.

Skills

Cortex XSOAR experience

Version control (Git)

Incident response knowledge

Software engineering best practices

Tools

Microsoft Sentinel

ServiceNow

Job description

Security Automation Engineer – Managed Detection & Response (MDR)

As a Security Automation Engineer, you will design, build, and maintain automated response capabilities using Palo Alto Cortex XSOAR. Your work will directly impact the efficiency and consistency of handling security incidents across complex customer environments, translating detection signals into automated, reliable, and auditable response workflows.

We strongly believe in SOAR as code—automation content is version‑controlled, tested, and continuously improved.

Key Responsibilities

• Security Automation & Playbook Development
  • Design, build, and maintain response playbooks in Cortex XSOAR for common and advanced security incidents.
  • Translate detection alerts from SIEM and XDR platforms into automated investigation and response flows.
  • Implement conditional logic, enrichment steps, human‑in‑the‑loop approvals, and automated containment actions.
• SOAR as Code
  • Manage playbooks, integrations, scripts, and content packs using version control (Git).
  • Apply software engineering best practices such as modularity, reusability, testing, and peer review.
  • Contribute to standardized automation frameworks that can be reused across customers.
• Platform Integrations
  • Build and maintain integrations between XSOAR and SIEM platforms, XDR/EDR solutions, ITSM tools, and identity, network, and cloud security controls.
  • Troubleshoot and optimize integrations for reliability, performance, and scalability.
• Incident Response Enablement
  • Collaborate closely with Detection Engineering and Incident Response teams to define automated investigation steps, response actions, containment strategies, and escalation handover points to analysts.
  • Continuously improve response quality based on real incident feedback.
• Automation Lifecycle Management
  • Maintain and evolve our automation content library.
  • Tune playbooks to reduce noise, false positives, and manual effort.

Core Technologies

• Palo Alto Cortex XSOAR
• Microsoft Defender XDR and other XDR platforms
• SIEM platforms such as Microsoft Sentinel
• ITSM platforms (ServiceNow and equivalents)
• Cloud, identity, network, and third‑party security tooling