Solution Architect - Security Investigations, SIEM

Job Summary

Senior AI & Automation Engineer – Cyber Security & Security Operations

Key Responsibilities

Security Automation Engineering • Design, develop, and maintain enterprise security automation solutions. • Identify repetitive security activities suitable for automation. • Build reusable automation frameworks and playbooks. • Automate security investigations and remediation workflows. • Develop Infrastructure-as-Code and Security-as-Code capabilities. • Standardize security operations across global environments. • Drive continuous improvement through automation and AI. ________________________________________ Security Operations (SOC) Automation Develop and maintain automation for: • Incident triage • Security alert enrichment • Threat intelligence collection • Malware response • Phishing investigations • Endpoint response • Privileged access reviews • Compliance validation Design workflows that: • Reduce analyst workload • Improve Mean Time to Detect (MTTD) • Improve Mean Time to Respond (MTTR) • Increase investigation consistency • Minimize false positives ________________________________________ Microsoft Security Platform Design and automate solutions across: Microsoft Sentinel • Incident automation • SOAR playbooks • Threat hunting workflows • Alert enrichment • Automated investigations • Security dashboards Microsoft Defender Suite • Defender XDR • Defender for Endpoint • Defender for Identity • Defender for Cloud Apps • Defender for Office 365 • Defender for Cloud Microsoft Entra ID • Identity Governance • Privileged Identity Management (PIM) • Conditional Access • Access Reviews • Identity Lifecycle Automation Microsoft Purview • Data Loss Prevention • Information Protection • Compliance automation • Data classification ________________________________________ AI-Powered Security Operations Build and support: • AI-driven threat detection • Security Copilot integrations • Copilot Studio security agents • Automated threat analysis • AI-assisted incident response • Security knowledge assistants • Security operations chatbots Develop solutions that: • Accelerate investigations • Improve threat correlation • Reduce manual analysis • Support proactive threat hunting ________________________________________ ServiceNow Security Operations Develop and optimize: • Security Incident Response workflows • Vulnerability Response processes • Risk Management workflows • Change Risk Assessment • Security Governance integrations Integrate ServiceNow with: • Microsoft Sentinel • Microsoft Defender • Vulnerability scanners • CMDB platforms • Identity systems • SIEM/SOAR tooling ________________________________________ Red Hat Ansible Security Automation Develop automation for: • Server hardening • Security configuration compliance • Vulnerability remediation • Patch deployment • Security baseline validation • Certificate lifecycle management Manage and maintain: • Ansible playbooks • Automation repositories • Configuration standards • Compliance frameworks The broader automation strategy highlights the use of industrialised automation through technologies such as Ansible, PowerShell, standardised patterns, and governed delivery processes. ________________________________________ Vulnerability & Compliance Automation Drive automation initiatives related to: • Vulnerability scanning • Patch compliance • Configuration drift detection • Security benchmarks • Regulatory compliance monitoring • Audit evidence collection Support frameworks such as: • ISO 27001 • NIST • CIS Controls • SOC2 • Corporate cyber security standards ________________________________________ Security Engineering & DevSecOps Support and automate: • Security controls validation • CI/CD security integrations • Infrastructure compliance checks • Secrets management • Certificate management • Application security workflows Implement: • Security guardrails • Automated approvals • Security policy enforcement • Compliance monitoring ________________________________________ Required Technical Skills Microsoft Security Stack Strong experience with: • Microsoft Sentinel • Microsof

Skill Requirements

Preferred Certifications Microsoft • Microsoft Certified Cybersecurity Architect Expert • Microsoft Security Operations Analyst • Microsoft Identity and Access Administrator Security • CISSP • CISM • GIAC Certifications • Security+ Automation • Red Hat Certified Specialist in Ansible Automation • Microsoft Power Platform Certifications ServiceNow • ServiceNow Certified System Administrator • ServiceNow Security Operations Specialist ________________________________________ Success Metrics Within the first 12 months, you will: • Reduce manual security operations workload. • Automate high-volume security investigations. • Decrease security incident response times. • Improve vulnerability remediation speed. • Improve compliance reporting accuracy. • Deploy AI-driven security assistants. • Increase automation coverage across security domains. • Improve audit readiness and evidence collection. • Reduce security operational costs. • Implement measurable Security-AIOps capabilities.

Other Requirements

Required Qualifications Education • Bachelor\'s degree in Cyber Security, Computer Science, Engineering, Information Technology, or equivalent experience. Experience • 5+ years within Cyber Security, Security Engineering, Security Operations, or Security Automation. • Experience working in enterprise-scale security environments. • Experience building automation and orchestration workflows. • Experience integrating Microsoft security technologies with ServiceNow. • Experience developing scripts and security automation solutions.