Security Automation Engineer

Chubb; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Job summary

Chubb Global Information Security seeks a hands-on Security Automation Engineer to build and maintain the automation platform powering day-to-day detection-to-response workflows for our SOC. This role focuses on SOAR, Python-based automations, and custom API integrations across EDR, SIEM, ticketing, identity, and network tools.

The ideal candidate will turn manual analyst tasks into reliable automation, document logic, and leverage AI tooling (Claude/Claude Code or similar) to accelerate triage,

Qualifications

• Hands-on security automation engineer with focus on SOAR platforms.
• Ability to design, build, and maintain automation for detection-to-response workflows.
• Experience with Python-based automation and custom API integrations.

Responsibilities

• Design, build, and maintain SOAR playbooks and Python-based automations.
• Own and evolve case and incident management applications and UI widgets.
• Build and maintain custom API integrations with various data sources.

Skills

Python scripting

SOAR engineering

Automation & RPA

Incident response

AI tooling (Claude)

Tools

Python

JavaScript

APIs

SOAR platform

EDR

SIEM

Job description

Chubb Global Information Security is looking for a hands-on Security Automation Engineer to build, own, and maintain the security automation platform that powers day-to-day detection-to-response workflows for our SOC. This role is responsible for our SOAR platform, including Python-based automation, custom API integrations, and the case and incident management tooling analysts rely on every day. The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation, and is comfortable using modern AI tooling (Claude/Claude Code or similar) as part of daily engineering work to build and extend that automation faster.

Responsibilities:

• Design, build, and maintain SOAR playbooks and Python-based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Own and evolve our case and incident management application, including analyst-facing workflows and JavaScript-based UI widgets
• Build and maintain custom API integrations, including non-standard auth schemes (e.g., HMAC request signing), pagination, and high-volume or rate-limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end-to-end, from alert ingestion through case closure
• Build and extend AI-assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows
• Evaluate new security tools and data sources for integration feasibility and automation potential