SOC Automation Engineer — AI-Powered SecOps

Ontinue; Northern (KY); Hybrid; USD 90,000 - 120,000; Full time

Job summary

Ontinue is seeking a SOC Automation Engineer to design, develop and maintain Python-based automation workflows that enhance security investigations and incident response. You will work at the intersection of cybersecurity, software engineering and automation to scale a 24/7 Security Operations Centre.

Join a team building end-to-end automation, with a focus on reliability, observability and measurable impact on analyst workload.

Qualifications

• At least three years of professional experience in software engineering, cybersecurity, security operations or automation engineering.
• Hands-on software development experience, including coding, API integrations, data processing, error handling and asynchronous programming.
• A solid understanding of SOC operations, including alert triage, incident investigation, enrichment, threat intelligence and response.
• Experience with the Microsoft Security ecosystem, preferably including Microsoft Sentinel and Microsoft Defender.
• Strong KQL skills and the ability to develop queries supporting security investigations and automation.

Responsibilities

• Design, develop and maintain Python-based automation workflows supporting security investigation, alert triage, enrichment, incident handling and response.
• Translate operational requirements and SOC analyst pain points into clearly defined, scalable automation use cases.
• Develop complex workflows using Temporal.io, following engineering best practices for reliability, scalability, maintainability and observability.
• Build integrations with security products, REST APIs, databases and other internal and external systems.
• Create automation capabilities across alert triage, threat intelligence, investigation, enrichment and incident response.
• Work with Microsoft Security technologies, including Microsoft Sentinel, Microsoft Defender and Defender XDR, along with their associated telemetry and APIs.
• Develop and optimise Kusto Query Language, or KQL, queries for investigation, enrichment, detection and automation use cases.
• Design robust business logic capable of handling complex investigation scenarios and operational edge cases.
• Partner closely with Cyber Defenders to validate requirements and ensure automation delivers meaningful operational value.
• Contribute throughout requirements analysis, technical design, implementation, testing and continuous improvement.
• Monitor and improve automation performance, reliability, coverage and its impact on analyst workload.
• Help shape the evolution of Ontinue’s SOC automation architecture and engineering standards.

Skills

Software engineering

Automation engineering

Cybersecurity

API integrations

Asynchronous programming

KQL queries

Tools

Temporal.io

Microsoft Sentinel

Microsoft Defender

Git

Job description

Ontinue is seeking a SOC Automation Engineer to design, develop and maintain Python-based automation workflows that enhance security investigations and incident response. You will work at the intersection of cybersecurity, software engineering and automation to scale a 24/7 Security Operations Centre.

Join a team building end-to-end automation, with a focus on reliability, observability and measurable impact on analyst workload.