Security Automation Engineer

Chubb Ltd.; Philadelphia, Northern (Philadelphia County, KY); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Chubb Global Information Security is seeking a hands-on Security Automation Engineer to build, own, and maintain the security automation platform that powers day-to-day detection-to-response workflows for our SOC. This role is responsible for our SOAR platform, including Python-based automation, custom API integrations, and the case and incident management tooling analysts rely on every day.

The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation,

Responsibilities

• Design, build, and maintain SOAR playbooks and Python-based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Own and evolve our case and incident management application, including analyst-facing workflows and JavaScript-based UI widgets
• Build and maintain custom API integrations, including non-standard auth schemes (e.g., HMAC request signing), pagination, and high-volume or rate-limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end-to-end, from alert ingestion through case closure
• Build and extend AI-assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows
• Evaluate new security tools and data sources for integration feasibility and automation potential

Job description

Chubb Global Information Security is looking for a hands-on Security Automation Engineer to build, own, and maintain the security automation platform that powers day-to-day detection-to-response workflows for our SOC. This role is responsible for our SOAR platform, including Python-based automation, custom API integrations, and the case and incident management tooling analysts rely on every day. The ideal candidate can turn a manual, repetitive analyst task into a reliable, documented automation, and is comfortable using modern AI tooling (Claude/Claude Code or similar) as part of daily engineering work to build and extend that automation faster.

Responsibilities:

• Design, build, and maintain SOAR playbooks and Python-based automations that integrate with EDR, SIEM, ticketing, identity, network, and threat intel tools
• Own and evolve our case and incident management application, including analyst-facing workflows and JavaScript-based UI widgets
• Build and maintain custom API integrations, including non-standard auth schemes (e.g., HMAC request signing), pagination, and high-volume or rate-limited data sources
• Partner with SOC analysts and incident responders to identify manual, repetitive tasks and automate them end-to-end, from alert ingestion through case closure
• Build and extend AI-assisted automation (Claude/Claude Code or similar) to accelerate triage, enrichment, and response
• Troubleshoot, monitor, and maintain existing automations and integrations, ensuring reliability as underlying tools and APIs change
• Document automation logic, connector configurations, and playbook behavior to support team continuity and knowledge transfer
• Translate manual security runbooks into automated, auditable workflows
• Evaluate new security tools and data sources for integration feasibility and automation potential