Security Automation Engineer

Pretium Enterprise Services; Charlotte (NC); Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

401(k) match

Health insurance

PTO / Paid time off

Holidays

Job summary

Pretium Enterprise Services is seeking a Security Automation Engineer to design, build, and operate SOAR workflows that automate investigation, enrichment, containment, and remediation across endpoints, email, and identity platforms. You will engineer secure integrations, validate telemetry coverage, and partner with MDR/SOC teams to reduce manual effort while improving reliability.

This hybrid role supports flexible locations with a preferred Scottsdale office and options including Charlotte,

Qualifications

• Bachelor’s degree in CS or cybersecurity is required or equivalent
• Strong Python or PowerShell skills and practical REST API, webhook and JSON experience
• Hands-on experience with SOAR or security automation
• Experience with MDR/SOC integrations and incident-response practices
• Ability to manage automation with version control and secure credential handling
• Experience engineering endpoint security and at least one other domain such as identity or network security

Responsibilities

• Design, build and maintain SOAR workflows for investigation, enrichment, containment and remediation
• Engineer integrations across endpoint, email, secure-access, identity, logging and ticketing platforms
• Own security platform configuration standards and validation of telemetry coverage
• Create reusable configuration patterns and onboarding checks for multi-tenant environments
• Document runbooks, mentor engineers, and track automation success and impact

Skills

Python

PowerShell

REST APIs

Webhooks

JSON

SOAR

Incident response

Endpoint security

MDR

Version control

Least privilege

Credentials handling

Automation testing

Education

Bachelor's Degree in Computer Science

Bachelor's Degree in Cybersecurity

Job description

Why Pretium Enterprise ServicesWith expert business service capabilities, Pretium Enterprise Services (“PES”), is integral to the growth, innovation, and transformation of its global operating companies. Partnering with internal and external businesses and stakeholders to rapidly unlock value for its customers, PES delivers with excellence and ownership, enabling scalable growth.Job OverviewPretium Enterprise Services is seeking a Security Automation Engineer to build and operate the integrations, response workflows and security platform controls that support its operating companies. This hands-on individual contributor role requires senior-level engineering experience and has no direct reports. You will improve the effectiveness of managed detection and response (MDR), reduce manual operational work, and make security services repeatable and reliable across environments. Your scope includes endpoint, email, web and private-access security, working with identity, cloud and AI security engineers on shared workflows.This role is hybrid three days a week in our office located in Scottsdale, Arizona (preferred location). Other locations that will considered: Dallas, Texas; Charlotte, North Carolina and California.What You Will DoAssess security platform configurations, integration health and recurring manual work. Prioritize an engineering roadmap with the Director of Cybersecurity based on risk, operational effort and business impact.Design, build and maintain security orchestration, automation and response (SOAR) workflows for investigation, enrichment, containment and remediation, using native platform capabilities and custom code where appropriate.Engineer integrations across endpoint, email, secure-access, identity, logging and ticketing platforms through APIs, webhooks and supported connectors.Own security platform configuration standards and integration reliability. Detect telemetry gaps, unhealthy agents, expired credentials and failed jobs; automate recovery or route actionable exceptions to the responsible team.Build and validate automated containment and remediation workflows. Define action scope, exclusions, approval thresholds and recovery procedures with service owners.Build production automation with least-privilege service access, secure secrets handling, input validation, retries, duplicate-event handling, audit logs and failure alerts. Test changes and stage deployments before broad rollout.Validate MDR telemetry coverage, response permissions and escalation paths. Work with the provider to resolve gaps and verify that contracted response actions work in each supported environment.Exercise detection-to-response workflows through controlled testing, validate containment outcomes, and turn incident lessons and recurring failures into engineering improvements.Create reusable configurations, integration patterns and acceptance checks for OpCo onboarding. Maintain separation of credentials, data and response scope across tenants and operating companies.Partner with IAM, cloud and AI security engineers on cross-platform workflows while those engineers retain ownership of their domain controls. Coordinate endpoint and network changes with the responsible IT teams.Document runbooks and support procedures, mentor engineers, and train operational backups. Track automation success, failure rates, response times, coverage and manual effort reduced.Who We Are Looking ForSenior-level security engineering experience with demonstrated ownership of production integrations and automation from design through ongoing support. Ability to independently diagnose problems and deliver verified improvements.Bachelor's Degree in Computer Science, Cybersecurity, IStrong Python or PowerShell skills and practical REST API, webhook and JSON experience. Able to troubleshoot authentication, permissions, rate limits and integration failures across security platforms.Hands-on experience building and operating SOAR or equivalent response automation, including testing, error handling, monitoring, auditability and recovery. Experience must extend beyond configuring notifications or forwarding alerts.Practical incident-response experience and sound judgment about containment impact, service dependencies and when human approval is required. Ability to validate that automated actions achieved the intended outcome.Experience engineering endpoint security and at least one additional domain such as email, web, identity or network security, with the ability to learn and integrate unfamiliar products.Ability to manage automation through version control, peer review and controlled releases, with secure credential handling and least-privilege access.Experience troubleshooting telemetry and control-coverage gaps, working with MDR or SOC teams, and driving technical issues through resolution with vendors and internal owners.Clear documentation and communication skills, with the ability to explain operational tradeoffs, influence independent teams and transfer knowledge to other engineers.Preferred QualificationsExperience with enterprise EDR/XDR, MDR, SOAR or secure-access platforms; shared-services or multi-tenant environments; cloud-hosted automation; infrastructure as code; or detection validation. Relevant certifications and experience with equivalent technologies are welcome.What We OfferThis position offers the opportunity to join a collegial, entrepreneurial firm committed to the personal and professional growth of its team members and to maintaining a positive, encouraging work environment where people enjoy working together. The company offers a comprehensive benefits and perks package, including:401(k) plan with an employer matchHealth, dental, vision and life insurancePaid Time Off (PTO)11 firm holidaysHybrid office/work from home arrangementAnnual year-end bonus eligiblePretium Enterprise Services is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment regardless of race, color, religion, gender, gender identity or expression, genetic information, marital status, sexual orientation, national origin, disability, age, veteran status, or any other characteristic protected by federal, state, or local law.