SOAR Expert

NATIONMIND LLC; Charlotte (NC); Remote; USD 90,000 - 120,000; Full time

Job summary

A cybersecurity firm is seeking a Remote SOAR Expert to operate on Splunk and Palo Alto XSOAR. The ideal candidate will have experience customizing SOAR tools and developing with Python. Responsibilities include integrating SOC systems and onboarding data sources. Strong web development skills and communication abilities are highly valued. This role offers flexibility and the opportunity to work in an impactful cyber security area.

Qualifications

• Experience in customization on any SOAR tool, preferably Palo Alto XSOAR.
• Development experience with Python and web frameworks (Django, Flask).
• Experience with log management and/or SIEM technologies such as Splunk.

Responsibilities

• Operational role on Splunk & XSOAR.
• Work closely on Palo Alto XSOAR platform to customize it.
• Integrate existing SOC systems through development of well-defined APIs.

Skills

Customization on SOAR tools

Development experience with Python

Log management with SIEM technologies

Web development frontend skills

Communication skills

Knowledge of incident response

Tools

Splunk

Palo Alto XSOAR

Django

Flask

SQL databases

Linux

git

nginx

Job description

Overview

SOAR Expert — Remote

Responsibilities

• Operational role on Splunk & XSOAR (our Soar platform).
• Should have significant experience with Python.
• Will work closely on Palo Alto XSOAR platform to customize it as needed.
• Will closely integrate existing Security Operation Center (SOC) systems through development and reuse of well-defined APIs.
• Working with stakeholders for onboarding new data sources on Splunk (or any other SIEM tool) and perform periodic maintenance activities.
• Deploy and evaluate external proof-of-concept tools.
• Help with automation of various SOC related manual tasks.

Must Have

• Experience in customization on any SOAR (Security Orchestration, Automation and Response) tool preferably Palo Alto XSOAR
• Development experience with Python and web frameworks (Django, Flask)
• Experience with log management and/or SIEM technologies such as Splunk

Value

• Web development frontend skills: JavaScript, jQuery, HTML/CSS
• Experience in creating and reusing Restful APIs to improve integration between existing and new security systems
• SQL database or any other DBs
• Good communication skills
• Highly motivated individual with the ability to self-start, prioritize, and multi-task
• Interest in cyber security, willingness to follow security best practices
• Ability to understand code written in other scripting languages
• Knowledge of incident response (SecOps)
• Eagerness to look for and evaluate available open-source incident response/threat intelligence tools
• Strong focus on writing high quality technical documentation
• Good knowledge of Linux, git, nginx.

This is a remote position.