Security Automation Engineer

Pretium Enterprise Services, India; Scottsdale (AZ); Hybrid; USD 110,000 - 165,000; Full time

Benefits offered by this job

401(k) plan with employer match

Health, dental, vision and life

Paid Time Off

11 firm holidays

Hybrid office/work from home

Annual bonus eligible

Job summary

Pretium Enterprise Services is seeking a Security Automation Engineer to design, build and operate SOAR-driven workflows across endpoint, identity, and cloud security. This hands-on role emphasizes automation, reliability, and production-grade integration across multiple platforms.

Senior-level candidates will own security platform configurations, validate telemetry, and work closely with MDR/SOC teams to reduce manual work and improve detection-to-response.

Qualifications

• Senior-level security engineering experience with ownership of production integrations and automation.
• Bachelor's Degree in Computer Science or Cybersecurity.
• Strong Python or PowerShell skills and REST API/webhook/JSON experience.
• Hands-on experience with SOAR or equivalent automation, including testing, monitoring, and recovery.
• Incident-response experience and judgment on containment impact and dependencies.
• Experience with endpoint security and at least one domain like email or identity.
• Experience managing automation with version control and least-privilege credentials.
• Ability to communicate tradeoffs and transfer knowledge across teams.

Responsibilities

• Assess configurations, health, and manual work; prioritize engineering roadmap with Cybersecurity leadership.
• Design and maintain SOAR workflows for investigation, containment and remediation.
• Engineer integrations across endpoint, identity, logging, and ticketing systems via APIs and webhooks.
• Own platform configuration standards and reliable integrations; detect telemetry gaps and automate recovery.
• Build automated containment and remediation workflows with defined scopes and approvals.
• Ensure least-privilege access, secrets handling, retries, and auditability in automation.
• Validate MDR telemetry coverage and escalation paths with providers across environments.
• Document runbooks, mentor engineers, and track automation success and coverage.

Skills

Security engineering

Python/PowerShell

SOAR experience

REST API/webhooks

Incident response

Education

Bachelor's degree in Computer Science or Cybersecurity

Tools

SOAR platforms

MDR tools

EDR/XDR

Job description

Why Pretium Enterprise Services

With expert business service capabilities, Pretium Enterprise Services (“PES”), is integral to the growth, innovation, and transformation of its global operating companies. Partnering with internal and external businesses and stakeholders to rapidly unlock value for its customers, PES delivers with excellence and ownership, enabling scalable growth.

Job Overview

Pretium Enterprise Services is seeking a Security Automation Engineer to build and operate the integrations, response workflows and security platform controls that support its operating companies. This hands-on individual contributor role requires senior-level engineering experience and has no direct reports. You will improve the effectiveness of managed detection and response (MDR), reduce manual operational work, and make security services repeatable and reliable across environments. Your scope includes endpoint, email, web and private-access security, working with identity, cloud and AI security engineers on shared workflows.

This role is hybrid three days a week in our office located in Scottsdale, Arizona (preferred location). Other locations that will considered: Dallas, Texas; Charlotte, North Carolina and California.

What You Will Do

• Assess security platform configurations, integration health and recurring manual work. Prioritize an engineering roadmap with the Director of Cybersecurity based on risk, operational effort and business impact.
• Design, build and maintain security orchestration, automation and response (SOAR) workflows for investigation, enrichment, containment and remediation, using native platform capabilities and custom code where appropriate.
• Engineer integrations across endpoint, email, secure-access, identity, logging and ticketing platforms through APIs, webhooks and supported connectors.
• Own security platform configuration standards and integration reliability. Detect telemetry gaps, unhealthy agents, expired credentials and failed jobs; automate recovery or route actionable exceptions to the responsible team.
• Build and validate automated containment and remediation workflows. Define action scope, exclusions, approval thresholds and recovery procedures with service owners.
• Build production automation with least-privilege service access, secure secrets handling, input validation, retries, duplicate-event handling, audit logs and failure alerts. Test changes and stage deployments before broad rollout.
• Validate MDR telemetry coverage, response permissions and escalation paths. Work with the provider to resolve gaps and verify that contracted response actions work in each supported environment.
• Exercise detection-to-response workflows through controlled testing, validate containment outcomes, and turn incident lessons and recurring failures into engineering improvements.
• Create reusable configurations, integration patterns and acceptance checks for OpCo onboarding. Maintain separation of credentials, data and response scope across tenants and operating companies.
• Partner with IAM, cloud and AI security engineers on cross-platform workflows while those engineers retain ownership of their domain controls. Coordinate endpoint and network changes with the responsible IT teams.
• Document runbooks and support procedures, mentor engineers, and train operational backups. Track automation success, failure rates, response times, coverage and manual effort reduced.

Who We Are Looking For

• Senior-level security engineering experience with demonstrated ownership of production integrations and automation from design through ongoing support. Ability to independently diagnose problems and deliver verified improvements.
• Bachelor's Degree in Computer Science, Cybersecurity, I
• Strong Python or PowerShell skills and practical REST API, webhook and JSON experience. Able to troubleshoot authentication, permissions, rate limits and integration failures across security platforms.
• Hands-on experience building and operating SOAR or equivalent response automation, including testing, error handling, monitoring, auditability and recovery. Experience must extend beyond configuring notifications or forwarding alerts.
• Practical incident-response experience and sound judgment about containment impact, service dependencies and when human approval is required. Ability to validate that automated actions achieved the intended outcome.
• Experience engineering endpoint security and at least one additional domain such as email, web, identity or network security, with the ability to learn and integrate unfamiliar products.
• Ability to manage automation through version control, peer review and controlled releases, with secure credential handling and least-privilege access.
• Experience troubleshooting telemetry and control-coverage gaps, working with MDR or SOC teams, and driving technical issues through resolution with vendors and internal owners.
• Clear documentation and communication skills, with the ability to explain operational tradeoffs, influence independent teams and transfer knowledge to other engineers.

Preferred Qualifications

Experience with enterprise EDR/XDR, MDR, SOAR or secure-access platforms; shared-services or multi-tenant environments; cloud-hosted automation; infrastructure as code; or detection validation. Relevant certifications and experience with equivalent technologies are welcome.

What We Offer

This position offers the opportunity to join a collegial, entrepreneurial firm committed to the personal and professional growth of its team members and to maintaining a positive, encouraging work environment where people enjoy working together. The company offers a comprehensive benefits and perks package, including:

• 401(k) plan with an employer match
• Health, dental, vision and life insurance
• Paid Time Off (PTO)
• 11 firm holidays
• Hybrid office/work from home arrangement
• Annual year-end bonus eligible

Pretium Enterprise Services is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment regardless of race, color, religion, gender, gender identity or expression, genetic information, marital status, sexual orientation, national origin, disability, age, veteran status, or any other characteristic protected by federal, state, or local law.