Senior Cyber Detection & Response Automation Engineer

Blackbaud; United States; Remote; USD 117,000 - 158,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Remote-flexible workforce

Wellness Programs

401(k) program with employer match

Flexible paid time off

Generous Parental Leave

Donations for Doers

Pet insurance, legal and identity保护

Tuition reimbursement program

Job summary

Blackbaud seeks a Cyber Detection & Response Automation Engineer to design and maintain automation across SIEM, SOAR, EDR, and cloud tools. The role emphasizes AI/ML or LLM-assisted triage, safe data onboarding, and scalable detections within a security operations context.

You will build integrations, craft detection logic, and drive automated response strategies aligned with MITRE ATT&CK, while advancing CI/CD practices for security content.

Qualifications

• 5+ years building automation, orchestration, or SOAR playbooks in a cyber security or SOC environment.
• 3+ years SIEM engineering/administration experience including data onboarding and rule development.
• Strong Python or scripting skills with API/integration experience across security and IT tooling.
• Hands-on AI/ML/LLM tooling experience applied to security use cases (triage, enrichment, anomaly detection).
• Familiarity with MITRE ATT&CK and mapping detections to adversary techniques.
• Experience with a SOAR or security orchestration platform (NG-SIEM Fusion, Splunk SOAR, XSOAR, etc.).
• Cloud security experience (AWS, Azure, GCP) with automation for security data ingestion/processing.
• CI/CD, IaC, and version-controlling security content.
• Familiarity with containerized/serverless environments and their automation/logging.
• Security automation platform certifications preferred.

Responsibilities

• Design, build, and maintain orchestration workflows and SOAR playbooks to automate triage, enrichment, containment, and response actions.
• Apply AI/ML/LLM techniques to reduce analyst workload and speed decision-making.
• Develop Python-based integrations connecting SIEM, SOAR, EDR, ticketing, threat intel, and cloud platforms.
• Design, tune SIEM correlation rules and alerts mapped to MITRE ATT&CK for automated responses.
• Own SIEM administration tasks: data onboarding, health, log ingestion, configuration management.
• Build custom field extractions, parsers, and content packs for new data sources.
• Tune detections and automation to reduce false positives and MTTR.
• Create dashboards and reporting for automation coverage and detection effectiveness.
• Apply CI/CD and IaC practices to manage detection content as code.
• Evaluate and pilot new automation and AI tooling to expand capabilities.

Skills

Automation design

SOAR playbooks

Python scripting

AI/ML or LLM tooling

MITRE ATT&CK knowledge

SOAR platform experience

Cloud security (AWS/Azure/GCP)

CI/CD and IaC

Containerized/serverless environments

Security automation experience

Tools

NG-SIEM Fusion

Splunk SOAR

Palo Alto XSOAR

Tines

Job description

Blackbaud seeks a Cyber Detection & Response Automation Engineer to design and maintain automation across SIEM, SOAR, EDR, and cloud tools. The role emphasizes AI/ML or LLM-assisted triage, safe data onboarding, and scalable detections within a security operations context.

You will build integrations, craft detection logic, and drive automated response strategies aligned with MITRE ATT&CK, while advancing CI/CD practices for security content.