Hybrid AI-Driven Security Automation Engineer

TransUnion; Chicago (IL); Hybrid; USD 113,000 - 188,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Spousal/partner coverage options

Life and AD&D insurance

Parental leave programs

401(k) with employer match

Employee Stock Purchase Plan (ESPP)

Tuition reimbursement

Paid time off and holidays

Job summary

TransUnion is seeking a senior cybersecurity engineer to lead the design and maintenance of AI-driven security response automations, migrating Splunk SOAR playbooks and building end-to-end agentic workflows. You will integrate SIEM, EDR, threat intel, and ITSM platforms using REST APIs and webhooks, primarily coding in Python.

You will collaborate with distributed teams, contribute to engineering standards, and drive measurable improvements in MTTR and false positives.

Qualifications

• 10+ years of experience in security engineering or software engineering with a strong cybersecurity focus.
• Hands-on experience with SOAR or security automation platforms such as Splunk SOAR, Cortex XSOAR, Tines, Torq, or similar technologies.
• Experience building solutions with modern Large Language Model platforms such as Anthropic Claude, OpenAI, Amazon Bedrock, or similar platforms, including agent design, prompt design, tool-use patterns, and model-output evaluation.
• Working knowledge of Security Operations Center operations, incident response workflows, and the MITRE ATT&CK framework.
• Strong software engineering fundamentals, documentation practices, written communication skills, and experience working effectively within a distributed global team.

Responsibilities

• Lead the design, development, and maintenance of security response automations on the agentic AI SOC platform, including the migration of existing Splunk SOAR playbooks.
• Build agentic workflows from end to end, including prompt and agent design, tool integration, guardrails, output evaluation, and human-in-the-loop review for AI-driven triage and response.
• Develop and maintain integrations across SIEM, EDR, threat intel, case management, and ITSM platforms using REST APIs, webhooks, and event-driven patterns.
• Build internal tools, services, and APIs primarily in Python to expand platform capabilities and reduce repetitive work for security analysts.
• Administer and improve the case management platform and its supporting workflows.
• Partner with detection engineering teams to convert new security detections into automated response workflows.
• Contribute to shared engineering standards through Git-based development, code reviews, automated testing, and CI/CD practices.
• Measure the effectiveness of automation through throughput, mean time to respond or remediate, false-positive burden, and analyst time saved.
• Create clear technical documentation and runbooks while collaborating across a global, distributed team.

Skills

Python development

REST APIs

Git-based development

OAuth / secrets management

Webhooks

LLM tooling / agent design

Agentic AI security platforms

Security operations knowledge

Tools

Splunk SOAR

Cortex XSOAR

Tines

Torq

Anthropic Claude

OpenAI / Bedrock

FastAPI / Flask

AWS / Docker / Kubernetes

Job description

TransUnion is seeking a senior cybersecurity engineer to lead the design and maintenance of AI-driven security response automations, migrating Splunk SOAR playbooks and building end-to-end agentic workflows. You will integrate SIEM, EDR, threat intel, and ITSM platforms using REST APIs and webhooks, primarily coding in Python.

You will collaborate with distributed teams, contribute to engineering standards, and drive measurable improvements in MTTR and false positives.