SOAR & Security Automation Engineer — Incident Response

Cognizant; Raleigh (NC); On-site; USD 115,000 - 134,000; Full time

Benefits offered by this job

Medical/Dental/Vision/Life Insurance

Paid holidays + PTO

401(k) plan

Job summary

Cognizant's Cloud Infrastructure & Security Services Practice seeks an Automation / Orchestration / Security Engineer to design, build, and maintain security automation solutions. The role collaborates with Security Operations, Incident Response, IT, and Cloud/Platform teams to automate workflows and implement scalable, auditable security processes.

Applicants should have 3+ years in automation/sec roles, strong Python/PowerShell/JS, and hands-on experience with SIEM, IAM, and cloud security

Qualifications

• 3+ years in Automation/Security/Operations engineering or related roles.
• Strong programming/scripting: Python, PowerShell, or JavaScript.
• Experience with automation/orchestration platforms (Ansible, Itential, Aria/VMware).
• Hands-on with REST APIs, JSON, webhooks, OAuth2, and mutual TLS.
• SIEM concepts, incident triage, escalation, and response.
• IAM, endpoint and cloud security fundamentals.
• GIT workflows, code reviews, testing practices.
• Excellent documentation and communication with technical and non-technical stakeholders.
• Preferred: vulnerability management automation, SLA reporting, and cloud security across AWS/Azure/GCP.
• Familiarity with EDR/XDR integrations and ITSM tools (ServiceNow, Jira).

Responsibilities

• Design and deliver security automation and orchestration to improve response times.
• Develop and maintain SOAR playbooks for triage, enrichment, containment, and remediation.
• Create integrations with SIEM, EDR/XDR, IAM, vulnerability mgmt, ticketing, and cloud security tools via APIs and events.
• Build reusable automation components with logging, monitoring, and error handling.
• Automate SOC procedures and runbooks with approval gates as needed.
• Implement governance including RBAC, change management, audit logging, and docs.
• Collaborate with infra and engineering to automate security controls and policy-as-code.
• Support incident response with automation for evidence collection and containment.
• Ensure secure coding practices to prevent misuse of automation workflows.
• Create and maintain operating procedures, runbooks, and knowledge transfer materials.

Tools

Ansible

Itential

VMware Aria Orchestrator

REST APIs

JSON

Webhooks

OAuth2

mTLS

ServiceNow

Jira

Job description

Cognizant's Cloud Infrastructure & Security Services Practice seeks an Automation / Orchestration / Security Engineer to design, build, and maintain security automation solutions. The role collaborates with Security Operations, Incident Response, IT, and Cloud/Platform teams to automate workflows and implement scalable, auditable security processes.

Applicants should have 3+ years in automation/sec roles, strong Python/PowerShell/JS, and hands-on experience with SIEM, IAM, and cloud security