Senior Cyber SOAR & Automation Engineer

Blackbaud; Charleston (SC); Hybrid; USD 117,000 - 158,000; Full time

Benefits offered by this job

Remote-flexible workforce

Medical, dental, and vision insurance

401(k) with employer match

Generous PTO

Tuition reimbursement

Donations for Doers

Pet insurance

Job summary

Blackbaud seeks a Cyber Detection & Response Automation Engineer to design and maintain automation and SOAR workflows that reduce analyst effort and accelerate response. You will integrate SIEM, SOAR, EDR, and cloud data, applying AI-assisted techniques to triage and enrich alerts while tuning detection logic.

You’ll own core SIEM tasks, build pipelines, and craft content packs, with a focus on MITRE ATT&CK mappings and scalable automation across the security stack.

Qualifications

• 5+ years building automation, orchestration, or SOAR playbooks in a cyber security or SOC environment.
• 3+ years of SIEM engineering or administration experience.
• Strong Python skills and experience building APIs across security tools.
• Hands-on AI/ML or LLM tooling for security use cases.
• Working knowledge of MITRE ATT&CK and mapping detections to tactics.
• Experience with SOAR platforms (NG-SIEM Fusion, Splunk SOAR, XSOAR, or similar).
• Cloud security experience (AWS, Azure, GCP).
• CI/CD, IaC, and version-controlling content.

Responsibilities

• Design, build, and maintain orchestration workflows and SOAR playbooks across the security tool stack.
• Apply AI/ML and LLM-assisted techniques to reduce analyst workload and speed decision-making.
• Develop Python-based integrations connecting SIEM, SOAR, EDR, ticketing, threat intel, and cloud platforms.
• Design and tune SIEM correlation rules and alerts mapped to MITRE ATT&CK.
• Own SIEM administration tasks: data onboarding, health, and configuration.
• Create content packs and parsers for new data sources.
• Tune detections to reduce false positives and MTTR.
• Create dashboards measuring automation coverage and detection effectiveness.
• Apply CI/CD practices to manage content as code.
• Pilot new automation tools to expand the automation footprint.

Skills

Automation & Orchestration

SIEM engineering

Python scripting

AI/ML for security

MITRE ATT&CK

SOAR platform

Cloud security

CI/CD & IaC

Container/serverless

Security certifications

Tools

NG-SIEM Fusion

Splunk SOAR

Palo Alto XSOAR

Tines

Job description

Blackbaud seeks a Cyber Detection & Response Automation Engineer to design and maintain automation and SOAR workflows that reduce analyst effort and accelerate response. You will integrate SIEM, SOAR, EDR, and cloud data, applying AI-assisted techniques to triage and enrich alerts while tuning detection logic.

You’ll own core SIEM tasks, build pipelines, and craft content packs, with a focus on MITRE ATT&CK mappings and scalable automation across the security stack.