XSOAR Engineer

PwC India; Mumbai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

PwC India in Mumbai is seeking a security engineer to develop Palo Alto XSOAR playbooks for incident response automation and to integrate XSOAR with SIEM, EDR, firewalls, and threat intel.

You will build Python/JavaScript scripts and optimize SOAR workflows, while guiding SOC teams and documenting architectures, configurations, and runbooks. 3–7 years of XSOAR experience and strong security automation knowledge are required.

Qualifications

• 3-7 years of hands-on experience with Palo Alto XSOAR.
• Strong knowledge of SOAR, incident response, and security automation.
• Proficiency in Python and/or JavaScript.
• Experience with SIEM integrations (Splunk, ArcSight, ELK).
• Knowledge of REST APIs, webhooks, and workflow automation.
• Familiarity with firewalls, EDR, and vulnerability management tools.

Responsibilities

• Develop and manage Palo Alto XSOAR playbooks for incident response automation.
• Integrate XSOAR with SIEM, EDR, firewalls, and threat intelligence platforms.
• Build custom automation scripts using Python/JavaScript.
• Optimize SOAR workflows, performance, and response processes.
• Troubleshoot XSOAR issues and provide technical guidance to SOC teams.
• Document architectures, configurations, and operational runbooks.

Skills

Palo Alto XSOAR

SOAR & incident response

Python

JavaScript

SIEM integrations

REST APIs & webhooks

Firewalls & EDR

Tools

Docker

Kubernetes

CI/CD

Job description

Key Responsibilities

• Develop and manage Palo Alto XSOAR playbooks for incident response automation.
• Integrate XSOAR with SIEM, EDR, firewalls, and threat intelligence platforms.
• Build custom automation scripts using Python/JavaScript.
• Optimize SOAR workflows, performance, and response processes.
• Troubleshoot XSOAR issues and provide technical guidance to SOC teams.
• Document architectures, configurations, and operational runbooks.

Required Skills

• 3-7 years of hands‑on experience with Palo Alto XSOAR.
• Strong knowledge of SOAR, incident response, and security automation.
• Proficiency in Python and/or JavaScript.
• Experience with SIEM integrations (Splunk, ArcSight, ELK).
• Knowledge of REST APIs, webhooks, and workflow automation.
• Familiarity with firewalls, EDR, and vulnerability management tools.

Preferred

• XSOAR Certification.
• Experience with Docker, Kubernetes, CI/CD, and Threat Intelligence platforms.
• SOC or Incident Response background.