Cortex XSOAR Engineer - Playbook & Integration Developer

WSNE Consulting Pvt. Ltd.; Mumbai; On-site; INR 900,000 - 1,700,000; Full time

Job summary

WSNE Consulting Pvt. Ltd. in Mumbai and Hyderabad seeks Cortex XSOAR Engineers (Playbook & Integration Developers) for hands-on security automation projects across enterprise clients.

Design, develop, test and maintain Cortex XSOAR / XSIAM playbooks, build Python and JavaScript integrations using REST APIs, webhooks and demisto-sdk, and integrate SIEM/EDR systems. You will enable incident response workflows with clients and SOC teams.

Qualifications

• Hands-on Cortex XSOAR (Demisto) or XSIAM playbook development experience is a must.
• Strong Python scripting and REST API integration skills.
• Good understanding of SOC processes, incident response and security tools (SIEM, EDR, email security, TI).
• Certifications such as PCSAE, PCDRA, SC‑200 or Splunk SOAR are a plus.

Responsibilities

• Design, develop, test and maintain Cortex XSOAR / XSIAM playbooks for incident response use cases (phishing, malware, EDR alerts, account compromise, vulnerability response, threat‑intel enrichment, etc.)
• Build custom integrations, automations and scripts in Python (and JavaScript where needed) using REST APIs, JSON, webhooks and the XSOAR SDK / demisto-sdk
• Integrate SIEM (QRadar, Splunk, Sentinel, XSIAM), EDR/XDR (Cortex XDR, CrowdStrike, Defender), ITSM (ServiceNow, Jira), email, firewall, IAM and threat‑intel platforms with XSOAR
• Translate SOC use‑case documents into automated workflows; create incident types, layouts, fields, classifiers and mappers
• Deploy, configure, upgrade and administer XSOAR (standalone / multi‑tenant, engines, content packs, marketplace)
• Troubleshoot playbook and integration failures, optimise performance and document HLD / LLD and runbooks
• Work with clients and SOC teams to gather requirements; for AM / DM levels, lead delivery, review code and mentor juniors

Skills

Cortex XSOAR

XSIAM

Python scripting

REST API integration

SOC processes

EDR/XDR tools

Demisto SDK

Tools

Demisto SDK

Job description

We are hiring Cortex XSOAR Engineers (Playbook & Integration Developers) for a leading global professional services firm at its Mumbai and Hyderabad offices. This is a hands‑on SOAR ENGINEERING / DEVELOPMENT role - not SOC monitoring or L1/L2 alert triage.

Open levels and budget (fixed CTC):

• Consultant: 1.5 - 3 years, up to Rs 9 LPA
• Assistant Manager: 3.1 - 6 years, up to Rs 13 LPA
• Deputy Manager: 6.1 - 9 years, up to Rs 17 LPA

Location: Mumbai (incl. Thane / Navi Mumbai) or Hyderabad - candidates currently based in these cities only.

Notice period: Immediate to 60 days (immediate joiners preferred).

Interview: Face-to-face / Video interview drive on Saturday, 10 October 2026.

Role & responsibilities:

• Design, develop, test and maintain Cortex XSOAR / XSIAM playbooks for incident response use cases (phishing, malware, EDR alerts, account compromise, vulnerability response, threat‑intel enrichment, etc.)
• Build custom integrations, automations and scripts in Python (and JavaScript where needed) using REST APIs, JSON, webhooks and the XSOAR SDK / demisto-sdk
• Integrate SIEM (QRadar, Splunk, Sentinel, XSIAM), EDR/XDR (Cortex XDR, CrowdStrike, Defender), ITSM (ServiceNow, Jira), email, firewall, IAM and threat‑intel platforms with XSOAR
• Translate SOC use‑case documents into automated workflows; create incident types, layouts, fields, classifiers and mappers
• Deploy, configure, upgrade and administer XSOAR (standalone / multi‑tenant, engines, content packs, marketplace)
• Troubleshoot playbook and integration failures, optimise performance and document HLD / LLD and runbooks
• Work with clients and SOC teams to gather requirements; for AM / DM levels, lead delivery, review code and mentor juniors

Preferred candidate profile:

• Hands‑on Cortex XSOAR (Demisto) or XSIAM playbook development experience is a must
• Strong Python scripting and REST API integration skills
• Good understanding of SOC processes, incident response and security tools (SIEM, EDR, email security, TI)
• Certifications such as PCSAE (Palo Alto Certified Security Automation Engineer), PCDRA, SC‑200 or Splunk SOAR are a plus
• Good communication skills; consulting / client-facing exposure preferred for AM / DM
• Stable career history preferred (no job change in the last 12 months)

Why join:

• Work with a leading global professional services firm on large enterprise security automation programmes
• Exposure to multiple clients, the latest Palo Alto Cortex platforms and structured career growth