XSOAR Engineer (Secret clearance)

Ateko, backed by Bell Canada; Ottawa; On-site; CAD 80,000 - 100,000; Full time

Job summary

Ateko, backed by Bell Canada, is seeking a candidate with valid Secret security clearance to deploy and configure the Palo Alto Cortex Security Orchestration, Automation, and Response (XSOAR). Responsibilities include building automation playbooks, implementing incident ingestion, and supporting Security Operations Centre operations. Candidates should possess hands-on experience with Cortex XSOAR and familiarity with incident response workflows. This role promotes an inclusive workplace with opportunities for personal growth.

Qualifications

• 3–7+ years in Security Operations, Incident Response, or Security Engineering.
• 2–4+ years hands‑on experience with Cortex XSOAR.
• Experience implementing playbooks and automation in production SOC environments.

Responsibilities

• Deploy and configure Cortex XSOAR platform components.
• Implement incident ingestion from Elastic SIEM into XSOAR.
• Build and maintain automation playbooks.

Skills

Hands‑on experience with Palo Alto Cortex XSOAR

Experience building automation playbooks and integrations

Strong knowledge of application programming interfaces (APIs)

Scripting experience (Python preferred)

Understanding of incident response workflows

Experience with Linux systems and troubleshooting

Job description

Valid Secret security clearance required

Role Overview

Deploy, configure, and operationalize Palo Alto Cortex Security Orchestration, Automation, and Response (XSOAR), implementing automation playbooks, integrations, and incident workflows to support the Security Operations Centre (SOC).

Key Responsibilities

• Deploy and configure Cortex XSOAR platform components
• Implement incident ingestion from Elastic SIEM into XSOAR
• Build and maintain automation playbooks
  • Phishing response
• Configure and maintain integrations with
  • Elastic SIEM
  • Endpoint Detection and Response (EDR) tools
  • Firewalls and network tools
  • Identity and Access Management (IAM) systems
  • Ticketing platforms (ServiceNow, Jira)
• Implement Role-Based Access Control (RBAC) and tenant separation
• Configure incident types, fields, layouts, and workflows (SecIM)
• Perform testing and validation of playbooks and integrations
• Troubleshoot
  • API connectivity issues
• Support platform monitoring, upgrades, and maintenance
• Assist with automation scripting (Python, APIs)
• Support deployment automation and configuration management
• Work closely with Architects and SOC teams to refine workflows

Required Skills

• Hands‑on experience with Palo Alto Cortex XSOAR
• Experience building automation playbooks and integrations
• Strong knowledge of application programming interfaces (APIs)
• Scripting experience (Python preferred)
• Understanding of incident response workflows
• Experience with Linux systems and troubleshooting

Ideal Candidate Experience

• 3–7+ years in Security Operations, Incident Response, or Security Engineering
• 2–4+ years hands‑on experience with Cortex XSOAR
• Experience implementing playbooks and automation in production SOC environments
• Experience integrating SIEM, EDR, identity, and ticketing tools
• Familiarity with
  • Continuous Integration and Continuous Deployment (CI/CD) pipelines
  • Infrastructure as Code (IaC) (nice to have)
• Experience in large-scale or enterprise environments
• Exposure to regulated environments

We’re committed to fostering an inclusive, equitable, and accessible workplace where every team member feels valued, respected, and supported, and has the opportunity to reach their full potential. We welcome and encourage applications from people with disabilities.