Threat Detection & SOAR Automation Engineer

IBM; Bogotá; Híbrido; COP 60.000.000 - 90.000.000; Jornada completa

Descripción de la vacante

IBM Consulting in Bogotá seeks a Technical Consultant to manage defense-in-depth security infrastructure and deploy use cases and policy recommendations across SIEM, SOAR, EDR, and Cloud controls. You will design automation playbooks, integrate tools via REST APIs, and contribute to incident investigations alongside SOC and engineering teams.

The role emphasizes hands-on SecOps experience, strong scripting with Python, and collaboration within a global delivery network.

Formación

• Hands-on experience operating Google SecOps (Chronicle) and/or Palo Alto XSIAM.
• Solid understanding of security automation concepts (playbooks, rules, workflows).
• Practical knowledge of REST API integrations between security platforms.
• Strong understanding of SIEM, XDR/EDR, and how security controls operate within a SecOps ecosystem.
• Experience with alert analysis, IOC handling, and incident investigation.
• 2+ years of experience in similar SecOps, SOC Engineering, or Security Automation roles.
• Intermediate English level (technical communication).

Responsabilidades

• Operate and administer Google SecOps (Chronicle) and/or Palo Alto XSIAM platforms.
• Design, configure, and maintain automation workflows, including playbooks and rules.
• Develop and maintain custom automation actions using Python.
• Integrate security tools and data sources via REST APIs.
• Analyze indicators of compromise (IOCs) and support security incident investigations.
• Collaborate with SOC and engineering teams to improve detection, response, and automation maturity.

Conocimientos

Security automation

IOC handling

Incident investigation

Python

English communication

Educación

Bachelor's Degree

Herramientas

Google SecOps (Chronicle)

Palo Alto XSIAM

IBM SOAR

Descripción del empleo

IBM Consulting in Bogotá seeks a Technical Consultant to manage defense-in-depth security infrastructure and deploy use cases and policy recommendations across SIEM, SOAR, EDR, and Cloud controls. You will design automation playbooks, integrate tools via REST APIs, and contribute to incident investigations alongside SOC and engineering teams.

The role emphasizes hands-on SecOps experience, strong scripting with Python, and collaboration within a global delivery network.