Lead Engineer, Cyber Defense Automation

TransUnion; Bengaluru; On-site; INR 4,000,000 - 6,500,000; Full time

Job summary

TransUnion in Bengaluru, India, is seeking a Lead Engineer in Cybersecurity to design and implement security automation for an AI-driven SOC platform. You will migrate playbooks from Splunk SOAR, build end-to-end agentic workflows, and integrate across SIEM, EDR, threat intel, and ITSM using REST APIs and webhooks.

The role requires strong Python in production, experience with SOAR platforms, and familiarity with modern LLM tooling and CI/CD practices.

Qualifications

• 5+ years in security engineering, automation, or software with security focus.
• Strong Python in production; REST APIs, JSON, webhooks, OAuth and secrets handling.
• Hands-on with SOAR or security automation platforms (Splunk SOAR, XSOAR, etc.).
• Experience with modern LLM platforms using APIs, SDKs and eval of model output.
• Fundamentals: Git, code review, automated testing, CI/CD; strong SOC knowledge.

Responsibilities

• Design, build, and maintain security automation on our AI SOC platform.
• Lead migration of Splunk SOAR playbooks and create end-to-end agentic workflows.
• Develop integrations across SIEM, EDR, threat intel, case management via REST/webhooks.
• Build internal tools and APIs in Python to extend platform capabilities.
• Administer the case management platform and workflows; document and runbooks.
• Collaborate with detection engineering to automate detections into response.
• Contribute to Git-based workflows, code review, testing, and CI/CD.
• Measure automation throughput, MTTR, false positives; improve analyst efficiency.

Skills

Python in production

REST APIs & Webhooks

SOAR / security automation

LLM platforms

Incident response

Git / CI/CD

Documentation & communication

Tools

Splunk SOAR

XSOAR

Tines

Torq

Job description

TransUnion Job Title Lead Engineer, Cybersecurity

Role Overview And Core Responsibilities

What You’ll Do:

• Design, build, and maintain security response automations on our agentic AI SOC platform, and help lead the migration of existing Splunk SOAR playbooks
• Build agentic workflows end to end: prompt and agent design, tool integration, guardrails, output evaluation, and human-in-the-loop review for AI-driven triage and response
• Develop and maintain integrations across the security stack (SIEM, EDR, threat intelligence, case management, ITSM) using REST APIs, webhooks, and event-driven patterns
• Build internal tools, services, and APIs, primarily in Python, that extend platform capability and reduce analyst toil
• Administer and improve the case management platform and its workflows
• Partner with detection engineering to operationalize new detections into automated response
• Contribute to shared engineering standards: Git-based workflows, code review, testing, and CI/CD
• Measure what you build: automation throughput, MTTR, false-positive burden, and analyst time saved
• Write clear documentation and runbooks; collaborate effectively across a global, distributed team

Required Knowledge And Experiences

What You’ll Bring:

• 5+ years in security engineering, security automation, or software engineering with a strong security focus
• Strong Python in production settings, with solid command of REST APIs, JSON, webhooks, and authentication patterns (OAuth, API keys, secrets handling)
• Hands‑on experience with SOAR or security automation platforms (Splunk SOAR, XSOAR, Tines, Torq, or similar)
• Experience building with modern LLM platforms (Anthropic Claude, OpenAI, Amazon Bedrock, or similar): using APIs, SDKs, and tool‑use patterns to build tools, integrations, and agents, with practical prompt and agent design and evaluation of model output for reliability and safety
• Software engineering fundamentals: Git, code review, automated testing, CI/CD
• Working knowledge of SOC operations and incident response workflows; familiarity with MITRE ATT&CK
• Strong documentation habits and written communication; effective in a distributed global team

We’d Love to See

• Experience with agentic AI security platforms, or building autonomous or semi‑autonomous agent systems in production
• Fine‑tuning, systematic evaluation (evals), or red‑teaming of LLMs
• Comfort using AI‑assisted development tools (Claude Code, Cursor, Copilot) as part of a disciplined engineering workflow
• Splunk Enterprise Security exposure (SPL, detection logic) or detec‑tion‑as‑code experience
• Case management or ITSM platform experience (ServiceNow or similar)
• Web service development (FastAPI, Flask, or similar); front‑end expo‑sure a plus AWS, Docker/Kubernetes, Terraform; DevOps background
• Experience mentoring engineers or leading technical workstreams

TransUnion Overview

At TransUnion, we encourage and are committed to creating a real, positive impact and shared sense of purpose within our Workforce for Good, which empowers our people to grow, innovate and contribute to a better future for our communities and customers. We strive to build an environment where our associates are in the driver’s seat of their professional development— while having access to help along the way. We recognize that success comes when our associates thrive both professionally and personally; that’s why we prioritize work/life flexibility and offer resources for our teams across the globe to collaborate and drive excellence. Be a part of our Workforce for Good – you’ll work with great people, pioneering products and cutting‑edge technology.