Splunk engineer with SOAR automation (Cortex)

Global Business Ser. 4u; Charlotte (NC); On-site; USD 95,000 - 125,000; Full time

Job summary

Global Business Ser. 4u in Charlotte, NC is seeking a SOC Integration Engineer to customize Palo Alto XSOAR, integrate SOC systems via well-defined APIs, and onboard new data sources into Splunk or other SIEM tools. You will also deploy proof-of-concept tools and automate routine SOC tasks.

The role requires 2+ years of SOAR customization, 5+ years of Python/web framework experience, and Splunk/SIEM expertise, with strong frontend and API integration skills in a security context.

Qualifications

• Min. 2 years of experience in customization on any SOAR (Security Orchestration, Automation and Response) tool preferably Palo Alto XSOAR
• Min. 5 years of development experience with Python and web frameworks (Django, Flask)
• Experience with log management and/or SIEM technologies such as Splunk

Responsibilities

• Will work closely on Palo Alto XSOAR platform to customize it as needed
• Will closely integrate existing Security Operation Center (SOC) systems through development and reuse of well-defined APIs
• Working with stakeholders for onboarding new data sources on Splunk (or any other SIEM tool) and perform periodic maintenance activities
• Deploy and evaluate external proof-of-concept tools
• Help with automation of various SOC related manual tasks.

Skills

Python

Django

Flask

JavaScript

jQuery

HTML/CSS

Git

Linux

nginx

REST APIs

Tools

Palo Alto XSOAR

Splunk

RESTful APIs

NGINX

Git

Job description

• Will work closely on Palo Alto XSOAR platform to customize it as needed
• Will closely integrate existing Security Operation Center (SOC) systems through development and reuse of well-defined APIs
• Working with stakeholders for onboarding new data sources on Splunk (or any other SIEM tool) and perform periodic maintenance activities
• Deploy and evaluate external proof-of-concept tools
• Help with automation of various SOC related manual tasks.

Key Responsibilities

• Will work closely on Palo Alto XSOAR platform to customize it as needed
• Will closely integrate existing Security Operation Center (SOC) systems through development and reuse of well-defined APIs
• Working with stakeholders for onboarding new data sources on Splunk (or any other SIEM tool) and perform periodic maintenance activities
• Deploy and evaluate external proof-of-concept tools
• Help with automation of various SOC related manual tasks.

Must Have

• Min. 2 years of experience in customization on any SOAR (Security Orchestration, Automation and Response) tool preferably Palo Alto XSOAR
• Min. 5 years of development experience with Python and web frameworks (Django, Flask)
• Experience with log management and/or SIEM technologies such as Splunk

Value

• Web development frontend skills: JavaScript, jQuery, HTML/CSS
• Experience in creating and reusing Restful APIs to improve integration between existing and new security systems
• SQL database or any other DBs
• Good communication skills
• Highly motivated individual with the ability to self-start, prioritize, and multi-task
• Interest in cyber security, willingness to follow security best practices
• Ability to understand code written in other scripting languages
• Knowledge of incident response (SecOps)
• Eagerness to look for and evaluate available open-source incident response/threat intelligence tools
• Strong focus on writing high quality technical documentation
• Good knowledge of Linux, git, nginx