AI-Driven Security Automation Architect

WTW; Madrid; On-site; EUR 90,000 - 130,000; Full time

Job summary

WTW in Madrid, Spain is seeking an AI Security & Automation Engineer to design and implement automated security workflows that boost detection and response capabilities across the organization. You will collaborate with Global ICSD, leverage LLMs and SOAR platforms, and deliver scalable, secure automation solutions while promoting secure coding practices within engineering teams.

The role emphasizes incident response acceleration, SOP development, and contributing to audits and enablement

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience.
• 5+ years in cybersecurity with focus on security engineering and automation.
• Proficient in scripting (Python/PowerShell/Bash) and automation platforms (Azure Logic Apps).
• Experience with SOAR tools (Microsoft Sentinel, Splunk SOAR, Cortex XSOAR).
• Familiar with LLMs (Claude, GPT-4, OpenAI, Azure OpenAI) and RESTful APIs.

Responsibilities

• Design and deploy AI-driven security agents to automate security operations and workflows.
• Utilize LLM-powered platforms to support threat hunting, triage, investigations, and response.
• Build and maintain SOAR playbooks integrated with SIEMs, EDRs, and identity platforms.
• Lead automation initiatives to reduce manual tasks and improve visibility of security controls.
• Develop and refine SOPs, playbooks, and standards for security operations.

Skills

Python scripting

PowerShell

Bash

Security engineering

LLM integration

Education

Bachelor's degree in Computer Science or Information Security

Tools

Azure Logic Apps

Microsoft Sentinel

Splunk SOAR

Cortex XSOAR

JSON

RESTful APIs

Azure OpenAI

Microsoft Defender XDR

Job description

WTW in Madrid, Spain is seeking an AI Security & Automation Engineer to design and implement automated security workflows that boost detection and response capabilities across the organization. You will collaborate with Global ICSD, leverage LLMs and SOAR platforms, and deliver scalable, secure automation solutions while promoting secure coding practices within engineering teams.

The role emphasizes incident response acceleration, SOP development, and contributing to audits and enablement