SOAR & Security Automation Engineer

Cognizant; Des Moines (IA); On-site; USD 115,000 - 134,000; Full time

Benefits offered by this job

Medical/Dental/Vision/Life Insurance

401(k) plan and contributions

Paid holidays and PTO

Long-term/Short-term Disability

Paid Parental Leave

Employee Stock Purchase Plan

Job summary

Cognizant is seeking an Automation / Orchestration / Security Engineer to design, build, and maintain security automation across SIEM, EDR/XDR, IAM, and cloud security. You will partner with Security Operations, Incident Response, IT, and Cloud/Platform teams to integrate tools and automate workflows.

The role emphasizes governance, RBAC, audit logs, and documentation, with responsibilities to develop SOAR playbooks, add logging and observability, and support incident response with evidence

Qualifications

• 3+ years of experience in Automation Engineering, Security Engineering, Security Operations Engineering, or related roles.
• Strong programming/scripting experience with Python (preferred), PowerShell, or JavaScript.
• Experience with automation and orchestration platforms such as Ansible, Itential, VMware Aria Orchestrator, or similar tools.
• Hands-on experience with REST APIs, JSON, webhooks, OAuth2, token-based authentication, and mutual TLS.
• Working knowledge of SIEM concepts including log ingestion, correlation, querying, and SOC operations such as incident triage, escalation, and response.
• Strong understanding of IAM, endpoint security, network security, vulnerability management, and cloud security fundamentals.
• Experience with Git workflows, code reviews, branching strategies, and software testing practices.
• Strong documentation and communication skills with both technical and non-technical stakeholders.
• Preferred Qualifications
• Experience with vulnerability management automation, remediation tracking, workflow automation, exception handling, and SLA reporting.
• Cloud security experience across AWS, Azure, and/or GCP.
• Familiarity with container and Kubernetes security.
• Experience integrating and automating actions within EDR/XDR platforms, including endpoint isolation, process termination, and quarantine operations.
• Experience with ITSM and workflow tools such as ServiceNow and Jira.

Responsibilities

• Design and deliver security automation and orchestration capabilities to improve response times and operational efficiency.
• Develop and maintain SOAR playbooks for alert triage, enrichment, containment, remediation, and response workflows.
• Build integrations with security tools including SIEM, EDR/XDR, IAM, vulnerability management, ticketing platforms, and cloud security solutions using APIs, webhooks, and event-driven architectures.
• Create reusable automation components such as scripts, libraries, and templates with proper logging, monitoring, error handling, and observability.
• Work with SOC and Incident Response teams to automate operational procedures and runbooks while implementing approval gates where required.
• Implement governance controls including RBAC, change management, audit logging, and documentation.
• Collaborate with infrastructure and engineering teams to automate security controls, compliance checks, policy-as-code, system hardening, and configuration drift remediation.
• Support incident response activities through automation for evidence collection, containment, and remediation while maintaining logging and chain-of-custody requirements.
• Ensure secure coding practices and implement safeguards to prevent misuse of automation workflows.
• Create and maintain documentation, operating procedures, runbooks, and knowledge transfer materials.

Skills

Automation Engineering

Security Engineering

Security Operations

Python

PowerShell

JavaScript

Ansible

REST APIs

Git workflows

Documentation

Tools

Itential

VMware Aria Orchestrator

ServiceNow

Jira

Kubernetes

Job description

Cognizant is seeking an Automation / Orchestration / Security Engineer to design, build, and maintain security automation across SIEM, EDR/XDR, IAM, and cloud security. You will partner with Security Operations, Incident Response, IT, and Cloud/Platform teams to integrate tools and automate workflows.

The role emphasizes governance, RBAC, audit logs, and documentation, with responsibilities to develop SOAR playbooks, add logging and observability, and support incident response with evidence