Senior AI-Driven Security Automation Engineer (SOAR)

Relha LLC; Chicago, Northern (IL, KY); Hybrid; USD 113,000 - 188,000; Full time

Benefits offered by this job

401(k) with employer match

Employee Stock Purchase Plan (ESPP)

Tuition reimbursement

Paid time off (PI)

12 paid holidays

Commuter benefits

Employee discounts

Charitable gift matching

Paid volunteer time off

Corporate volunteer events

Legal plan

Pet insurance

Travel accident coverage

Life and AD&D insurance

Long-term disability

Wellness programs

Job summary

TransUnion is seeking a senior security engineer to lead automation design and development for our agentic AI SOC platform. You will migrate Playbooks, design end-to-end workflows, and build integrations across SIEM/EDR and ITSM using REST APIs and event-driven patterns.

You will develop Python-based tools, collaborate with detection engineering, and contribute to CI/CD and engineering standards, while ensuring effective automation metrics and thorough documentation.

Qualifications

• 10+ years of experience in security engineering, security automation, or software engineering with a strong cybersecurity focus.
• Hands-on experience with SOAR or security automation platforms such as Splunk SOAR, Cortex XSOAR, Tines, Torq, or similar technologies.
• Experience building solutions with modern Large Language Model platforms such as Anthropic Claude, OpenAI, Amazon Bedrock, or similar platforms, including agent design, prompt design, tool-use patterns, and model-output evaluation.
• Working knowledge of Security Operations Center operations, incident response workflows, and the MITRE ATT&CK framework.
• Strong software engineering fundamentals, documentation practices, written communication skills, and experience working effectively within a distributed global team.

Responsibilities

• Lead the design, development, and maintenance of security response automations on the agentic AI SOC platform, including the migration of existing Splunk SOAR playbooks.
• Build agentic workflows from end to end, including prompt and agent design, tool integration, guardrails, output evaluation, and human-in-the-loop review for AI-driven triage and response.
• Develop and maintain integrations across SIEM, EDR, threat intelligence, case management, and ITSM platforms using REST APIs, webhooks, and event-driven patterns.
• Build internal tools, services, and APIs primarily in Python to expand platform capabilities and reduce repetitive work for security analysts.
• Administer and improve the case management platform and its supporting workflows.
• Partner with detection engineering teams to convert new security detections into automated response workflows.
• Contribute to shared engineering standards through Git-based development, code reviews, automated testing, and CI/CD practices.
• Measure the effectiveness of automation through throughput, mean time to respond or remediate, false-positive burden, and analyst time saved.
• Create clear technical documentation and runbooks while collaborating across a global, distributed team.

Job description

TransUnion is seeking a senior security engineer to lead automation design and development for our agentic AI SOC platform. You will migrate Playbooks, design end-to-end workflows, and build integrations across SIEM/EDR and ITSM using REST APIs and event-driven patterns.

You will develop Python-based tools, collaborate with detection engineering, and contribute to CI/CD and engineering standards, while ensuring effective automation metrics and thorough documentation.