Cybersecurity Automation Architect - SOAR & IAM

Littler

Minneapolis (MN)

Hybrid

USD 154,000 - 169,000

Full time

14 days+

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Health benefits

401(k) plan

Paid time off

Parental leave

Job summary

Littler is seeking a Sr. Cybersecurity Automation Engineer to lead automation initiatives across security operations, IAM, and governance.

The role focuses on building secure, scalable workflows, integrating platforms, and measuring automation impact in a hybrid environment with monthly onsite requirements. The ideal candidate has 7+ years in cybersecurity with 4+ years in security automation, strong scripting (Python/PowerShell), and experience with SIEM/EDR, IAM, and IaC in a Microsoft/Azure

Qualifications

Bachelor’s degree or equivalent relevant experience.
Minimum 7+ years in cybersecurity, security engineering, security operations, or infrastructure security.
Minimum 4+ years of hands-on security automation, SOAR, workflow engineering, or security platform integration experience.
Hands-on experience designing and maintaining SOAR playbooks, automated triage workflows, enrichment processes, containment actions, and ticketing integrations.
Strong scripting and automation experience, including Python, PowerShell, REST APIs, JSON, and automation frameworks.
Experience integrating SIEM, EDR/XDR, IAM, threat intelligence, ServiceNow, and related cybersecurity platforms.
Experience with Infrastructure as Code, CI/CD security automation, Microsoft Azure, and cloud security technologies.
Ability to operate as a senior individual contributor who can build solutions, document patterns, mentor others, and advise technical and operational stakeholders.

Responsibilities

Security automation and orchestration across SOC domains.
Automate alert triage, enrichment, incident response, containment, and ticketing workflows.
Integrate SIEM, EDR, IAM, threat intelligence, GRC, and ticketing platforms.
Improve SOC efficiency through automation and orchestration.
Automate joiner/mover/leaver processes and privileged access workflows.
Integrate identity events into security monitoring and response processes.
Automate evidence collection, control monitoring, and audit workflows.
Develop dashboards, reporting, and compliance metrics.
Monitor and maintain automation platforms and workflows.