AI Security & Automations Engineer

WTW; Madrid; Presencial; EUR 70.000 - 110.000; Jornada completa

Descripción de la vacante

WTW is seeking an experienced AI Security & Automation Engineer to enhance security operations by designing scalable automated solutions. You will work with the ICSD function to streamline processes, accelerate incident response, and reduce overhead through intelligent automation.

The role combines cybersecurity operations expertise with scripting and automation to build resilient, scalable security infrastructure and playbooks for DevOps environments.

Formación

• Bachelor’s degree in computer science, information security, or related field, or equivalent experience.
• 5+ years in cybersecurity with focus on security engineering and automation.
• Proficiency scripting with Python/PowerShell/Bash; automation platforms like Azure Logic Apps.

Responsabilidades

• Design and deploy AI-driven security agents using LLMs to automate security operations.
• Leverage platforms like Microsoft Security Copilot for threat hunting, triage, investigations and response; create incident playbooks.
• Build and maintain SOAR playbooks integrated with SIEMs, EDRs, and IAM platforms.
• Lead automation initiatives to reduce manual tasks and improve reliability and visibility of controls.
• Ensure resilient, integrated automation workflows and 24/7 monitoring capabilities.
• Support administration of security tools within the Security Engineering team.
• Participate in POCs for new security and automation solutions.
• Develop SOPs, playbooks and standards for security operations.
• Assist in audits and investigations; promote secure coding/design practices.
• Create technical docs and enablement sessions to boost security awareness.

Conocimientos

Scripting

LLMs

SOAR design

Cloud security

RESTful APIs

Security operations

Cross-functional

Communication

Educación

Bachelor’s degree in CS/InfoSec

Herramientas

Azure Logic Apps

Microsoft Sentinel

Splunk SOAR

Cortex XSOAR

Descripción del empleo

The AI Security & Automation Engineer plays a pivotal role in enhancing the efficiency and maturity of the organisation’s security operations by designing and implementing robust automated solutions. Working in close collaboration with Global Information and Cyber Security Defence (ICSD) function, this role identifies opportunities to streamline processes, accelerate incident response, and reduce operational overhead through intelligent automation.

In addition to building scalable automation workflows this individual will contribute to the broader Security Engineering team, supporting the development and maintenance of the organization’s security infrastructure. The ideal candidate combines a deep understanding of cybersecurity operations with a strong background in scripting and automation platforms to build scalable, resilient, and secure systems.

Role and Responsibilities:

• Design and deploy AI-driven security agents leveraging Large Language Models (LLMs) to automate traditionally manual security operations and workflows.
• Leverage LLM-powered platforms such as Microsoft Security Copilot to support cybersecurity tasks including threat hunting, triage, investigations and response, and creating security incident response playbooks.
• Build and maintain SOAR playbooks integrated with various security platforms (e.g., SIEMs, EDRs, identity platforms) to streamline incident response and automation.
• Lead automation initiatives to eliminate manual processes, improve the reliability and visibility of security controls, and define metrics to measure the impact of process improvements.
• Ensure automation workflows and monitoring solutions are resilient, integrated, and optimized for 24/7 detection and response capabilities.
• Support the administration and management of security tools within the Security Engineering team.
• Participate in proof-of-concepts for innovative security and automation solutions.
• Lead security operations process improvements, including development and refinement of SOPs, playbooks, and standards.
• Support security audits, assist in incident investigations, and promote adherence to security best practices across DevOps environments.
• Create technical documentation and deliver enablement sessions to enhance security awareness and practices within engineering teams.
• Foster a culture of security excellence by promoting secure coding and design practices across the organization.

Required Qualifications:

• Bachelor’s degree in computer science, Information Security, or a related field, or equivalent work experience.
• 5+ years of experience in cybersecurity, with a focus on security engineering and automation.
• Comfortable writing scripts using languages such as Python, PowerShell, or Bash, and experience with automation platforms such as Azure Logic Apps,
• SOAR tools (e.g., Microsoft Sentinel, Splunk SOAR, Cortex XSOAR).
• Experience designing SOAR workflows for automated security response and incident triage.
• Proven experience with Large Language Models (LLMs) such as Claude, GPT-4, OpenAI, Azure OpenAI, or similar frameworks.
• Deep understanding of cybersecurity domains, including incident response, threat detection, and Identity and Access Management (IAM) principles.
• Experience with RESTful APIs, JSON, and integrating various security platforms.
• Familiarity with cloud platforms and cloud-native security services.
• Knowledge of Microsoft Security products such as Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender for Cloud, Microsoft Intune, etc.
• Solid understanding of ITSM and change control processes.
• Understanding log management, SIEM tools, endpoint detection and other security platforms.
• Other Knowledge, Skills and Abilities
• Strong communication and collaboration skills, with proven experience working in cross-functional global teams.
• Strong problem-solving and critical thinking skills for addressing security issues and finding effective solutions.
• Outstanding written and verbal communication skills.
• Ability to work both independently and collaboratively in a fast-paced environment.
• Strong communication skills, with the ability to explain security concepts to non-technical stakeholders.

Certifications (Preferred):

• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Certified Information Systems Security Professional (CISSP)
• Certified Automation Professional (CAP)
• Certified Cloud Security Professional (CCSP)
• CompTIA Security+ / CySA+ / CASP+
• Any other relevant security automation or cloud security certifications

We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email [e-mail].