Walk-in | SIEM - XSOAR Engineer

Deloitte Shared Services India; Bengaluru; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

Deloitte Shared Services India in Bengaluru seeks an experienced Cortex XSOAR specialist to design and maintain SOAR playbooks, automations, and incident workflows. You will support L2 operations within a 24x7 SOC, integrating XSOAR with SIEM/EDR/NDR and other security tools.

You will translate SOC use cases into scalable automation, troubleshoot failures, and continuously improve automation to reduce manual efforts and MTTR.

Qualifications

• Hands-on experience with Palo Alto Cortex XSOAR and developing/troubleshooting playbooks.
• Strong understanding of security operations and incident response processes.
• Experience integrating security products using REST APIs.
• Knowledge of MITRE ATT&CK and SOC workflows.

Responsibilities

• Provide L2 engineering and operational support for the Cortex XSOAR platform in a 24x7 SOC.
• Design, develop, configure, test and maintain SOAR playbooks, automations, integrations and incident workflows.
• Translate SOC use cases into scalable automation workflows and troubleshoot failed playbooks and API connectivity.
• Integrate XSOAR with SIEM, EDR/XDR, NDR, firewalls, WAF, Threat Intelligence and ITSM platforms.
• Develop automation to reduce manual SOC activities and support analysts.

Skills

Palo Alto Cortex XSOAR

XSOAR playbooks

REST APIs

JSON

HTTP/HTTPS

webhooks

Security operations

Incident response

Python scripting

Automation

SOAR integrations

SIEM/EDR/XDR/NDR/ITSM

MITRE ATT&CK

Education

B.E./B.Tech (Tier 1/2) or Masters in Information Security/CS

Palo Alto Cortex XSOAR certification/training

Security+, CySA+, GCIH or equivalent

Tools

Python

Job description

Role & responsibilities

• 3+ years of hands-on experience with Palo Alto Cortex XSOAR.
• Strong experience developing and troubleshooting XSOAR playbooks.
• Good understanding of REST APIs, JSON, HTTP/HTTPS and webhooks.
• Good understanding of security operations and incident response processes.
• Working knowledge of Python scripting for XSOAR automation.
• Ability to troubleshoot Python-based automation scripts.
• Experience integrating security products using REST APIs.
• Good understanding of SIEM, EDR/XDR, NDR, Firewall, Threat Intelligence and ITSM technologies.
• Understanding of MITRE ATT&CK and common SOC detection/response workflows.
• Provide L2 engineering and operational support for the Palo Alto Cortex XSOAR platform within a 24x7 SOC environment.
• Design, develop, configure, test and maintain SOAR playbooks, automations, integrations and incident workflows.
• Translate SOC use cases and analyst requirements into scalable and repeatable security automation workflows.
• Troubleshoot failed playbooks, integrations, automation scripts, incident-processing workflows and API connectivity issues.
• Integrate XSOAR with SIEM, EDR/XDR, NDR, firewalls, WAF, vulnerability management, threat intelligence, email security, IAM and ITSM platforms.
• Continuously identify opportunities to reduce manual SOC activities through automation and orchestration.
• Support L1/L2 SOC analysts in troubleshooting automated investigation and response workflows.
• Ensure SOAR automation follows defined security, change management, audit and operational standards.
• Configure and administer Cortex XSOAR incidents, incident types, layouts, fields, classifications, mappings and indicators.
• Develop and maintain XSOAR playbooks for security investigation, enrichment, containment, remediation and ticket management.
• Configure conditional logic, loops, manual approval steps, data transformations and automated tasks within playbooks.
• Customize out-of-the-box Palo Alto content packs and playbooks based on client requirements.
• Troubleshoot playbook execution failures and optimize playbook performance.
• Manage XSOAR jobs, integrations, instances, content packs and automation dependencies.
• Maintain documentation for playbooks, integrations, automation workflows and operational procedures.
• Develop automation for common SOC use cases.
• Implement human-in-the-loop controls for high-risk remediation activities.
• Identify repetitive SOC processes suitable for automation and recommend automation candidates.
• Develop automation metrics to demonstrate reduction in analyst effort and MTTR.
• Configure and troubleshoot XSOAR integrations with SIEM platforms, Microsoft Defender other security technologies.
• Validate API authentication, permissions, connectivity, commands and response payloads.
• Troubleshoot REST API, webhook, authentication and integration failures.
• Education: B.E./B.Tech (Tier 1/2) or Masters degree in Information Security, Computer Science, or a related field.
• Preferred Certifications: Palo Alto Networks Cortex XSOAR certification/training.
• Security+, CySA+, GCIH or equivalent security certifications