Security Automation Engineer

AlphaSense Oy; Delhi; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

AlphaSense Oy is building an AI-augmented Security Operations capability and seeks a Security Automation Engineer to join its team in Delhi. You will design, build, and maintain automation pipelines and tooling enabling AI-driven detections, investigations, and responses to operate at machine speed.

Collaborating with detection engineers, threat intelligence analysts, and AI/ML engineers, you will turn manual processes into observable, testable automation workflows that scale across the security

Qualifications

• 5+ years in security engineering, SecOps, or automation roles.
• Proficiency in Python and/or Go for scripting and tooling.
• Hands-on SOAR experience (Splunk SOAR, Palo Alto XSOAR, Tines, or similar).
• Experience with SIEM platforms (Splunk, Microsoft Sentinel, Google Chronicle).
• REST API integration and event-driven architecture.
• Understanding of threat detection logic (MITRE ATT&CK, kill chain).
• Familiarity with LLM/AI APIs and prompt-driven automation workflows.
• Version control and CI/CD practices (Git, GitHub Actions).
• Cloud security fundamentals (AWS, Azure, or GCP).
• Strong written documentation habits.

Responsibilities

• AI-Powered Response Automation: Design and operate SOAR playbooks and agentic AI workflows that triage, enrich, and respond to security alerts with minimal human intervention.
• Detection Engineering Support: Translate detection logic and AI model outputs into actionable, low-noise alerts. Tune thresholds and automate feedback loops to continuously improve signal quality.
• Integration & Pipeline Development: Build and maintain integrations between security tools (SIEM, EDR, TIP, identity platforms) and AI inference services using APIs, event streaming, and orchestration frameworks.
• Observability & Reliability: Instrument automation pipelines with metrics, logging, and alerting so the security ops team can trust and verify AI-driven decisions in production.
• Automation Testing & Validation: Write tests for playbooks and automation logic. Run purple-team exercises and tabletop simulations to validate that automated responses behave correctly under adversarial conditions.
• Cross-functional Collaboration: Partner with AI/ML, DevSecOps, and IT teams to embed security automation into infrastructure change management workflows.

Skills

Python

Go

SOAR

SIEM

REST API

LLM APIs

Git CI/CD

Cloud security

Documentation

Tools

Splunk SOAR

Palo Alto XSOAR

Tines

GitHub Actions

Docker

Kubernetes

OpenCTI

Job description

About the Role

We are building an AI-augmented Security Operations capability and need a Security Automation Engineer to sit at the intersection of security engineering and AI systems. You will design, build, and maintain the automation pipelines and tooling that allow our AI-driven detections, investigations, and responses to operate at machine speed. Working alongside detection engineers, threat intelligence analysts, and AI/ML engineers, you will turn manual processes into reliable, observable, and testable automation workflows ing system

Key Responsibilities

• AI-Powered Response Automation: Design and operate SOAR playbooks and agentic AI workflows that triage, enrich, and respond to security alerts with minimal human intervention.
• Detection Engineering Support: Translate detection logic and AI model outputs into actionable, low-noise alerts. Tune thresholds and automate feedback loops to continuously improve signal quality.
• Integration & Pipeline Development: Build and maintain integrations between security tools (SIEM, EDR, TIP, identity platforms) and AI inference services using APIs, event streaming, and orchestration frameworks.
• Observability & Reliability: Instrument automation pipelines with metrics, logging, and alerting so the security ops team can trust and verify AI-driven decisions in production.
• Automation Testing & Validation: Write tests for playbooks and automation logic. Run purple-team exercises and tabletop simulations to validate that automated responses behave correctly under adversarial conditions.
• Cross-functional Collaboration: Partner with AI/ML, DevSecOps, and IT teams to embed security automation into infrastructure change management workflows.

Who You Are

Basic Requirements

• 5+ years in security engineering, SecOps, or automation roles
• Proficiency in Python and/or Go for scripting and tooling
• Hands-on SOAR experience (Splunk SOAR, Palo Alto XSOAR, Tines, or similar)
• Experience with SIEM platforms (Splunk, Microsoft Sentinel, Google Chronicle)
• REST API integration and event-driven architecture
• Understanding of threat detection logic (MITRE ATT&CK, kill chain)
• Familiarity with LLM/AI APIs and prompt-driven automation workflows
• Version control and CI/CD practices (Git, GitHub Actions)
• Cloud security fundamentals (AWS, Azure, or GCP)
• Strong written documentation habits

Nice to Have

• Experience deploying or fine-tuning ML models for anomaly detection or NLP-based log analysis
• Familiarity with agentic AI frameworks (LangChain, AutoGen, CrewAI, or similar)
• Container and orchestration experience (Docker, Kubernetes)
• Certifications: CISSP, AWS Security Specialty, or equivalent
• Background in threat intelligence automation or Cyber Thread Intelligence platform integration (Malware Information Sharing Platform, OpenCTI)