Senior Cybersecurity Automation Architect

Littler; Charlotte (NC); Hybrid; USD 154,000 - 169,000; Full time

Job summary

The Sr. Cybersecurity Automation Engineer at Littler will act as the primary automation expert within the cybersecurity organization, partnering with SOC, IAM, Governance, Infrastructure Engineering, and IT Operations to design secure workflows and integrate platforms. This hybrid role can be resident in multiple U.S.

locations, with an onsite visit required monthly in Charlotte, NC. Responsibilities include building SOAR playbooks, automating incident response, identity lifecycle processes, and

Qualifications

• Bachelor’s degree or equivalent relevant experience.
• Minimum 7+ years in cybersecurity, security engineering, security operations, or infrastructure security.
• Minimum 4+ years of hands-on security automation, SOAR, workflow engineering, or security platform integration experience.
• Hands-on experience designing and maintaining SOAR playbooks, automated triage workflows, enrichment processes, containment actions, and ticketing integrations.
• Strong scripting and automation experience, including Python, PowerShell, REST APIs, JSON, and automation frameworks.
• Experience integrating SIEM, EDR/XDR, IAM, threat intelligence, ServiceNow, and related cybersecurity platforms.
• Experience with Infrastructure as Code, CI/CD security automation, Microsoft Azure, and cloud security technologies.

Responsibilities

• Security automation and orchestration.
• Design, develop, and maintain SOAR playbooks and security workflows.
• Automate alert triage, enrichment, incident response, containment, and ticketing.
• Integrate SIEM, EDR, IAM, threat intelligence, GRC and ticketing platforms.
• Improve SOC efficiency through automation and orchestration.
• Identity and access automation.
• Automate joiner, mover, leaver processes.
• Automate provisioning, deprovisioning, access reviews, and privileged access workflows.
• Support service account, non-human identity, and AI agent lifecycle management.
• Integrate identity events into security monitoring and response processes.
• Governance, risk, and compliance automation.
• Automate evidence collection, control monitoring, and audit workflows.
• Support ISO 27001, NIST CSF, CIS Controls, SOC2 and ISO 42001 compliance initiatives.
• Develop dashboards, reporting, and compliance metrics.
• Streamline risk, policy, and governance processes through workflow automation.
• Cloud and infrastructure automation.
• Develop Infrastructure as Code (Terraform, Bicep, ARM, etc.).
• Integrate security controls into CI/CD pipelines.
• Automate cloud security posture management and remediation.
• Maintain secure baselines and configuration standards.
• AI-assisted security automation.
• Implement AI-assisted investigation, triage, and response workflows.
• Support Microsoft Security Copilot and related AI security technologies.
• Develop secure AI automation with appropriate guardrails and governance.
• Evaluate emerging AI security capabilities.
• Operational improvement and enablement.
• Monitor and maintain automation platforms and workflows.
• Measure automation effectiveness and operational value.
• Document solutions, processes, and architecture.
• Mentor cybersecurity team members on automation best practices.

Skills

Identity and access management

Privileged access

Zero Trust

Security monitoring

SIEM

Incident response

SOC operating models

Cloud security

APIs security

Evidence collection

Education

Bachelor’s degree or equivalent relevant experience

Tools

Microsoft Azure

Microsoft Sentinel

Defender

Entra ID

ServiceNow

Job description

The Sr. Cybersecurity Automation Engineer at Littler will act as the primary automation expert within the cybersecurity organization, partnering with SOC, IAM, Governance, Infrastructure Engineering, and IT Operations to design secure workflows and integrate platforms. This hybrid role can be resident in multiple U.S.

locations, with an onsite visit required monthly in Charlotte, NC. Responsibilities include building SOAR playbooks, automating incident response, identity lifecycle processes, and