Cybersecurity Automation Engineer

Cybersecurity Jobs; Huntsville (AL); On-site; USD 112,000 - 170,000; Full time

Benefits offered by this job

Medical, dental, vision

401K with company matching

9/80 work schedule

Paid holiday shutdown

Job summary

Cybersecurity Jobs in Huntsville, AL seeks a security automation engineer to design and implement automation workflows across SIEM/SOAR, endpoint security, and cloud platforms. You will build integrations using REST APIs, web-hooks, SDKs, and scripting languages such as Python and PowerShell.

You will automate alert enrichment, evidence collection, and incident response actions while collaborating with security analysts to identify automation opportunities and translate operational playbooks

Qualifications

• 3+ years of experience in security engineering, security automation, software development, or related technical discipline.
• Experience developing automation solutions using Python, PowerShell, or comparable languages.
• Practical experience integrating enterprise platforms via APIs, including authentication, JSON handling, pagination, and error handling.
• Working knowledge of security operations, incident response processes, and common threats across endpoints, identity, network, and cloud.
• Experience with SIEM or SOAR platforms and workflow orchestration tools.
• Familiarity with Git, code review, testing, and secure development practices.
• Bachelor’s degree in cybersecurity, computer science, information technology, or equivalent practical experience.

Responsibilities

• Design, build, and maintain automation workflows across SIEM, SOAR, endpoint security, identity, vulnerability management, cloud, and ticketing platforms.
• Develop integrations using REST APIs, web-hooks, SDKs, and scripting languages such as Python and PowerShell.
• Automate alert enrichment, investigation support, case creation, evidence collection, notifications, and incident response actions.
• Engineer cross-platform correlation workflows to improve visibility and reduce manual effort.
• Collaborate with security analysts to identify automation opportunities and translate playbooks into technical workflows.

Skills

Security engineering

Security automation

Software development

Education

Bachelor's degree in cybersecurity, computer science, information technology, or related field

Tools

Git

REST APIs

PowerShell

Python

Azure Logic Apps

Azure Functions

Jira

KQL

Job description

Build security automation and integrations that connect SIEM and enterprise platforms to strengthen security operations at speed.

Responsibilities

• Design, build, and maintain automation workflows across SIEM, SOAR, endpoint security, identity, vulnerability management, cloud, and ticketing platforms
• Develop integrations using REST APIs, web-hooks, SDKs, and scripting languages such as Python and PowerShell
• Automate alert enrichment, investigation support, case creation, evidence collection, notifications, and incident response actions
• Engineer cross-platform correlation workflows to improve visibility, reduce manual effort, and enable faster security decisions
• Collaborate with security analysts and incident responders to identify automation opportunities and translate operational playbooks into technical workflows
• Automate vulnerability management tasks including asset enrichment, remediation ticket creation, ownership assignment, escalation, and closure validation
• Build safeguards into automated actions, including approval requirements, access restrictions, validation checks, and rollback procedures
• Implement secure integration practices, including authentication, secrets management, least-privilege access, and audit logging for integrations and service accounts
• Maintain automation code through version control, peer review, testing, documentation, and established change management processes
• Monitor automation health, troubleshoot failures, and handle API limits, platform changes, retries, and exception handling
• Document integration architectures, data flows, dependencies, operating procedures, and troubleshooting guidance
• Measure automation effectiveness using time saved, execution reliability, reduced manual handling, and improved response times
• Support security control implementation and audit readiness by automating evidence collection and reporting
• Identify and implement opportunities to apply AI to enhance security automation (alert enrichment, investigation summaries, incident prioritization, and response recommendations)
• Integrate AI capabilities into security workflows with human oversight, data protection, output validation, and audit logging
• Evaluate AI-assisted workflows for accuracy, reliability, and measurable improvements in analyst efficiency and response time

Requirements

• 3+ years of experience in security engineering, security automation, software development, or a related technical discipline
• Experience developing and maintaining automation solutions using Python, PowerShell, or comparable languages
• Practical experience integrating enterprise platforms via APIs, including authentication, JSON data handling, pagination, and error handling
• Working knowledge of security operations, incident response processes, and common endpoint, identity, network, and cloud threats
• Experience with SIEM or SOAR platforms and workflow orchestration tools
• Familiarity with Git, code review, testing, and secure development practices
• Ability to troubleshoot complex workflows and dependencies across multiple systems
• Strong written and verbal communication skills, including explaining technical solutions to nontechnical stakeholders
• Ability to prioritize work, manage competing requirements, and independently deliver maintainable solutions
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience

Technologies

• SIEM, SOAR, REST APIs, web-hooks, SDKs
• Python, PowerShell, Git, JSON
• Azure Logic Apps, Azure Functions
• Microsoft Intune, Palo Alto Networks, Jira, KQL
• CI/CD pipelines, infrastructure as code
• NIST incident response guidance, MITRE ATT&CK, CMMC, NIST SP 800-171
• Large language models (LLMs), AI-enabled security tools
• Azure Government, Microsoft GCC High

Benefits

• Medical, dental, vision
• 401K with company matching
• 9/80 work schedule
• Paid holiday shutdown

Other Qualifications & Desired Competencies

• Experience with Microsoft security technologies, Azure Logic Apps, Azure Functions, Microsoft Intune, Palo Alto Networks, or Jira
• Experience integrating AI capabilities, large language models (LLMs), or AI-enabled security tools into automation workflows, including understanding limitations and secure use
• Experience supporting Azure Government, Microsoft GCC High, or other regulated enterprise environments
• Familiarity with KQL, cloud automation, CI/CD pipelines, and infrastructure as code
• Experience implementing automated response actions with human approval and operational safeguards
• Familiarity with NIST incident response guidance, MITRE ATT&CK, CMMC, and NIST SP 800-171

Physical Demands

• Ability to work in an office environment (Constant)
• Required to sit and stand for long periods; talk, hear, and use hands and fingers to operate a computer and telephone keyboard (Frequent)

Clearance Level

• No Clearance

Salary Range

• USD 111,500 - 170,000 per yearly

ITAR Requirement

• Position requires access to information subject to compliance with the International Traffic Arms Regulations (ITAR) and/or the Export Administration Regulations (EAR)
• Applicants must qualify as a U.S. person under ITAR/EAR, or be approved for an export license by the governing agency
• U.S. person definition includes U.S. citizen, U.S. lawful permanent resident (green card holder), or protected individual such as refugee or asylee
• Some positions may require current U.S. Citizenship due to contract requirements

Location: Huntsville, AL (onsite)

Schedule: 9/80