Security Automation Engineer

Chubb in; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Job summary

Chubb Global Information Security is hiring a hands-on Security Automation Engineer to build and own the security automation platform powering SOC detection-to-response workflows. You will develop Python-based automations, API integrations, and case management tooling, with AI-assisted enhancements to speed triage and response.

The role involves maintaining SOAR playbooks, ensuring reliable integrations, and documenting automation logic for team continuity.

Qualifications

• 3-5 years of IT/security engineering experience, including hands-on scripting or automation work.
• Strong Python scripting ability, with experience building and debugging integrations against third-party REST APIs.
• Experience integrating disparate security tools (SIEM, EDR, ticketing/ITSM, email security, threat intel, or similar) via API.
• Comfortable using AI coding/analysis tools (Claude Code or similar) to build and maintain automation.
• Strong troubleshooting and debugging skills across multi-system workflows.
• Excellent communication skills - able to translate analyst and IR pain points into automated solutions.
• Solid documentation habits for technical automation logic and integration configurations.
• Strong time management and organizational skills.

Responsibilities

• Design, build, and maintain SOAR playbooks and Python-based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools.
• Build and maintain custom API integrations, including non-standard auth schemes (e.g., HMAC request signing), pagination, and high-volume or rate-limited data sources.
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end-to-end, from alert ingestion through case closure.
• Build and extend AI-assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response.
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change.
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer.
• Translate manual security runbooks into automated, auditable workflows.
• Evaluate new security tools and data sources for integration feasibility and automation potential.

Skills

Python scripting

IT/security engineering

AI tooling (Claude)

Troubleshooting

Communication skills

Tools

JavaScript

REST APIs

SOAR platforms

Job description

Chubb Global Information Security is looking for a hands‑on Security Automation Engineer to build, own, and maintain the security automation platform that powers day‑to‑day detection‑to‑response workflows for our SOC. This role is responsible for our SOAR platform, including Python‑based automation, custom API integrations, and the case and incident management tooling analysts rely on every day. The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation, and is comfortable using modern AI tooling (Claude/Claude Code or similar) as part of daily engineering work to build and extend that automation faster.

Responsibilities:

• Design, build, and maintain SOAR playbooks and Python‑based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Build and maintain custom API integrations, including non‑standard auth schemes (e.g., HMAC request signing), pagination, and high‑volume or rate‑limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end‑to‑end, from alert ingestion through case closure
• Build and extend AI‑assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows
• Evaluate new security tools and data sources for integration feasibility and automation potential

QUALIFICATIONS

• 3-5 years of IT/security engineering experience, including hands‑on scripting or automation work
• Strong Python scripting ability, with experience building and debugging integrations against third‑party REST APIs
• Experience integrating disparate security tools (SIEM, EDR, ticketing/ITSM, email security, threat intel, or similar) via API
• Comfortable using AI coding/analysis tools (Claude Code or similar) to build and maintain automation
• Strong troubleshooting and debugging skills across multi‑system workflows
• Excellent communication skills - able to translate analyst and IR pain points into automated solutions
• Solid documentation habits for technical automation logic and integration configurations
• Strong time management and organizational skills

Security Automation Engineer (Finance)

JOB DESCRIPTION

Chubb Global Information Security is looking for a hands‑on Security Automation Engineer to build, own, and maintain the security automation platform that powers day‑to‑day detection‑to‑response workflows for our SOC. This role is responsible for our SOAR platform, including Python‑based automation, custom API integrations, and the case and incident management tooling analysts rely on every day. The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation, and is comfortable using modern AI tooling (Claude/Claude Code or similar) as part of daily engineering work to build and extend that automation faster.

Responsibilities:

• Design, build, and maintain SOAR playbooks and Python‑based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Own and evolve our case and incident management application, including analyst‑facing workflows and JavaScript‑based UI widgets
• Build and maintain custom API integrations, including non‑standard auth schemes (e.g., HMAC request signing), pagination, and high‑volume or rate‑limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end‑to‑end, from alert ingestion through case closure
• Build and extend AI‑assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows
• Evaluate new security tools and data sources for integration feasibility and automation potential

QUALIFICATIONS

• 3-5 years of IT/security engineering experience, including hands‑on scripting or automation work
• Strong Python scripting ability, with experience building and debugging integrations against third‑party REST APIs
• Working knowledge of JavaScript for building or maintaining web‑based UI components
• Experience integrating disparate security tools (SIEM, EDR, ticketing/ITSM, email security, threat intel, or similar) via API
• Comfortable using AI coding/analysis tools (Claude Code or similar) to build and maintain automation
• Strong troubleshooting and debugging skills across multi‑system workflows
• Excellent communication skills - able to translate analyst and IR pain points into automated solutions
• Solid documentation habits for technical automation logic and integration configurations
• Strong time management and organizational skills

Preferred Qualifications:

• Hands‑on experience with a SOAR platform (Splunk SOAR/Phantom, Palo Alto XSOAR, Tines, or similar)
• Experience with case or incident management application design and configuration
• Exposure to agentic AI frameworks (e.g., LangGraph) for building AI‑assisted security workflows
• Familiarity with Microsoft Sentinel/KQL or another SIEM
• Security certifications such as Security+, GCIH, or similar
• Experience with enterprise security/infrastructure APIs (e.g., Microsoft Graph, Akamai EdgeGrid)

ABOUT US

Chubb is a world leader in insurance. With operations in 54 countries, Chubb provides commercial and personal property and casualty insurance, personal accident and supplemental health insurance, reinsurance, and life insurance to a diverse group of clients. The company is distinguished by its extensive product and service offerings, broad distribution capabilities, exceptional financial strength, underwriting excellence, superior claims handling expertise and local operations globally.

At Chubb, we are committed to equal employment opportunity and compliance with all laws and regulations pertaining to it. Our policy is to provide employment, training, compensation, promotion, and other conditions or opportunities of employment, without regard to race, color, religious creed, sex, gender, gender identity, gender expression, sexual orientation, marital status, national origin, ancestry, mental and physical disability, medical condition, genetic information, military and veteran status, age, and pregnancy or any other characteristic protected by law. Performance and qualifications are the only basis upon which we hire, assign, promote, compensate, develop and retain employees. Chubb prohibits all unlawful discrimination, harassment and retaliation against any individual who reports discrimination or harassment.