Lead Security Automation Consultant (SOAR / Azure) (copy)

Trility Consulting; United States; Remote; USD 124,000 - 207,000; Full time

Benefits offered by this job

Remote work within US

Sponsored learning opportunities

Flexible hours

Job summary

Trility Consulting LLC is seeking a senior Lead Security Automation Consultant for a six‑week remote engagement starting mid‑December 2026. You will design and implement security automation workflows across client use cases, integrating platforms like ServiceNow, Azure, and Defender, using Python, Azure Functions, and REST APIs.

You should bring 5+ years in security engineering, hands‑on automation experience, and the ability to work independently within a defined timeline.

Qualifications

• 5+ years in security engineering or related fields.
• Experience designing and implementing security automation solutions.
• Strong Python development with Azure Functions.
• Experience with REST APIs integrations.
• Experience with Microsoft Graph and Microsoft Entra ID.
• Ability to work independently on a defined project timeline.

Responsibilities

• Design, develop, and implement security automation workflows across several defined client use cases.
• Build integrations between security platforms and ServiceNow via REST APIs.
• Develop Python-based Azure Functions to support automation.
• Create and use KQL queries for Defender hunting.
• Implement automation with Tines or similar platforms.
• Collaborate with client stakeholders to translate requirements into automation solutions.
• Lead knowledge-transfer sessions with the client’s engineers.
• Ensure changes pass through client change-control processes.
• Troubleshoot and optimize automations for reliability.

Skills

Security engineering

Security automation

Python development

REST APIs

Change management

Problem solving

Communication

Documentation

Knowledge sharing

Tools

Azure Functions

KQL

Microsoft Graph

ServiceNow

Tines

Azure DevOps

Microsoft Entra ID

Defender

REST APIs

Azure Logic Apps

Job description

Who We Are

At Trility Consulting®, we’ve built a strong, remote-work culture where people thrive, grow, and support each other – earning us Great Place to Work® Certification. Headquartered in Central Iowa, we embrace flexible schedules and collaboration across geographically distributed teams serving clients from all corners of the United States and globally.

We seek team members with the grit necessary to forge paths where none previously existed, to get back up when circumstances knock them down, to adapt to the changing needs of the client even when it is uncomfortable, and to deliver on our commitments. Candidates must respect and value people, recognize that over-communication is barely good enough, thrive on solving complex problems, have a passion for building teams, and know that delivering what a client actually values is more important than their own predispositions. They understand value proposition, love delivering value, and take pride in learning the expansive and ever-changing business of clients. Candidates are self-motivated and relentlessly working to become more today than they were yesterday.

What You Will Do & The Experience You Will Need

Trility Consulting is seeking an experienced Lead Security Automation Consultant to support a short-term client engagement focused on building and implementing security automation workflows and integrations.

In this hands‑on role, you’ll work across several defined use cases, developing automated security workflows that connect platforms such as Tines, Microsoft Azure, ServiceNow, and other security tools. You’ll leverage Python, Azure Functions, Microsoft Graph, Microsoft Entra ID, KQL, and API integrations to automate security triage, case handling, and notifications while improving how information moves between systems.

We’re looking for a senior‑level engineer who can hit the ground running, work independently, and translate defined requirements into reliable, reusable automation solutions. Experience with Tines is welcome, but hands‑on experience with comparable security orchestration or workflow automation platforms is also relevant.

This project will be approximately six weeks, starting mid‑December 2026 and running through late January 2027. This is a remote 1099 contract position. Please no 3rd party, C2C.

Key Responsibilities

• Design, develop, and implement security automation workflows across several defined client use cases
• Build integrations between security platforms, ServiceNow, and other enterprise applications using REST APIs and Microsoft Graph
• Develop and maintain Python-based Azure Functions to support automation and integration requirements
• Build and work with KQL queries, particularly Microsoft Defender advanced hunting, to retrieve, filter, and analyze security data
• Develop automated workflows using Tines or comparable security orchestration and automation platforms
• Integrate security alerts, incident data, and case‑handling processes with ServiceNow
• Work with Microsoft Entra ID to support identity‑related automation, including group membership changes and application registration credentials
• Implement Azure DevOps pipelines to deploy Azure Functions and support controlled release processes
• Work within the client’s change‑control and approval processes to ensure changes are properly reviewed, tested, and deployed
• Troubleshoot, test, and optimize automation workflows and integrations to ensure reliability
• Build reusable components that other engineers can extend, develop supporting runbooks, and lead knowledge‑transfer sessions with the client’s engineer
• Collaborate with client stakeholders to understand requirements and translate them into practical automation solutions

What You Bring

• 5+ years of experience in security engineering, security automation, systems integration, or a related technical discipline
• Hands‑on experience designing and implementing security automation or workflow automation solutions
• Strong Python development experience, including building and deploying Azure Functions
• Experience writing and working with Kusto Query Language (KQL), particularly Microsoft Defender advanced hunting
• Experience integrating ServiceNow with security platforms or other enterprise applications
• Strong experience building and consuming REST APIs and developing application integrations
• Experience with Microsoft Graph and Microsoft Entra ID, including automating group membership changes and working with application registration credentials
• Experience implementing Azure DevOps pipelines to deploy Azure Functions
• Experience working within structured change‑control and approval processes
• Experience with a security orchestration or workflow automation platform such as Tines, Torq, Swimlane, Splunk SOAR, Cortex XSOAR, or Microsoft Sentinel Playbooks/Azure Logic Apps
• Ability to independently develop, troubleshoot, and deliver working automation solutions within a defined project timeline
• Strong problem-solving, communication, documentation, and knowledge‑sharing skills

Preferred Experience

• Direct, hands‑on experience with Tines
• Experience with Microsoft Sentinel and Sentinel playbooks
• Experience with Defender for Office 365 or Proofpoint email and click data
• Experience working with Tenable and Common Vulnerabilities and Exposures (CVE) data
• Experience integrating or working with Hunters security platform
• Familiarity with n8n, Power Automate, Workato, or other workflow automation platforms
• Experience building security triage, ticketing, and case‑management workflows
• Experience working in a consulting or professional services environment

How We Put You First

Trility’s culture is built upon the journey, character, and work ethic of our team members. We are a team of honorable and professional lifelong learners who work together to solve problems proactively.

• Work remotely anywhere in the United States with flexible work hours
• Sponsored and supported learning opportunities

Job Requirements

• Must reside within the United States
• Must be authorized to work in the United States without sponsorship now or in the future
• Must be able to pass a background check