Security Automation Engineer

Chubb Life Fund; Philadelphia (Philadelphia County); On-site; USD 120,000 - 160,000; Full time

Job summary

Chubb Global Information Security is seeking a hands-on Security Automation Engineer to build, own, and maintain the automation platform powering SOC workflows. You will design SOAR playbooks, Python automations, and custom API integrations while enhancing case and incident management tooling for analysts.

Ideal candidates turn manual analyst tasks into reliable automation, with comfort using AI tooling to accelerate triage, enrichment, and response.

Qualifications

• Hands-on experience in security automation and scripting.
• Ability to design, implement, and maintain automated workflows and playbooks.
• Experience turning manual analyst tasks into reliable automated processes.
• Familiarity with AI tooling and modern security automation practices.

Responsibilities

• Design, build, and maintain SOAR playbooks and Python-based automations.
• Own and evolve the case and incident management application, including UI widgets.
• Develop and integrate custom API connections, handling various auth schemes and data sources.
• Collaborate with SOC analysts to automate tasks from alert intake to case closure.
• Extend AI-assisted automation to speed triage, enrichment, and response.
• Troubleshoot and monitor automations to ensure reliability as tools evolve.
• Document automation logic and configurations for knowledge transfer.
• Translate runbooks into auditable automated workflows.
• Evaluate new tools and data sources for feasible automation.

Skills

Python

SOAR

API integrations

JavaScript

AI tooling

Tools

SOAR platform

EDR

SIEM

Ticketing systems

APIs

Job description

Chubb Global Information Security is looking for a hands‑on Security Automation Engineer to build, own, and maintain the security automation platform that powers day‑to‑day detection‑to‑response workflows for our SOC. This role is responsible for our SOAR platform, including Python‑based automation, custom API integrations, and the case and incident management tooling analysts rely on every day. The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation, and is comfortable using modern AI tooling (Claude/Claude Code or similar) as part of daily engineering work to build and extend that automation faster.

Responsibilities:

• Design, build, and maintain SOAR playbooks and Python‑based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Own and evolve our case and incident management application, including analyst‑facing workflows and JavaScript‑based UI widgets
• Build and maintain custom API integrations, including non‑standard auth schemes (e.g., HMAC request signing), pagination, and high‑volume or rate‑limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end‑to‑end, from alert ingestion through case closure
• Build and extend AI‑assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows
• Evaluate new security tools and data sources for integration feasibility and automation potential