{"id":2529537,"url":"https://alion.io/job/blackbaud-principal-security-engineer-orchestration-and-automation","title":"Principal Security Engineer, Orchestration and Automation","company":{"id":36535,"name":"Blackbaud","domain":"blackbaud.com","url":"https://alion.io/company/blackbaud","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":32,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":117200,"max":157500,"currency":"USD","period":"year","gross":null,"usd_annual":157500},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"GCP","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Tines","optional":false}],"status":"closed","first_seen_at":"2026-09-04T00:00:00Z","employer_posted_date":"2026-09-04","last_verified_at":"2026-10-29T14:56:25Z","board_verified":false,"closed_at":"2026-10-29T14:56:25Z","days_open":55,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":55},"description":"Cyber Detection & Response Automation Engineer\nThe Cyber Detection & Response Automation Engineer is responsible for building the automation, orchestration, and AI-driven capabilities that power the organization's detection and response function. This role treats the SIEM as one component in a broader automation ecosystem - the primary focus is designing workflows, integrations, and intelligent tooling that reduce manual analyst effort, accelerate response, and scale detection coverage. The ideal candidate is an automation/orchestration engineer with a security background: comfortable building integrations and pipelines across multiple tools, applying AI/ML or LLM-assisted techniques to triage and enrichment, and engineering detection logic. This person will also maintain a working level of SIEM platform administration - data onboarding, health, and configuration - to support the automation and detection layers built on top of it, and will partner closely with Security Operations and the Detection Engineering Lead.\nWhat you'll be doing:\nDesign, build, and maintain orchestration workflows and SOAR playbooks that automate triage, enrichment, containment, and response actions across the security tool stack.\nApply AI/ML and LLM-assisted techniques (e.g., automated alert summarization, natural-language investigation assistance, anomaly scoring) to reduce analyst workload and speed decision-making.\nDevelop and maintain Python-based integrations and APIs connecting the SIEM, SOAR, EDR, ticketing, threat intel, and cloud platforms into unified automated workflows.\nDesign, build, and tune SIEM correlation rules, alerts, and detection use cases mapped to MITRE ATT&CK, with an eye toward which detections can be paired with automated response.\nOwn core SIEM administration tasks needed to support automation and detection: data source onboarding, index/data model health, log ingestion monitoring, and configuration management.\nBuild and maintain custom field extractions, parsers, and content packs to ensure new data sources are automation- and detection-ready.\nContinuously tune detections and automation logic to improve signal-to-noise ratio, reduce false positives, and reduce mean-time-to-respond (MTTR).\nCreate dashboards and reporting that measure automation coverage, orchestration reliability, AI-assisted triage accuracy, and detection effectiveness.\nApply CI/CD and infrastructure-as-code practices to manage detection content, playbooks, and integrations as versioned, testable code.\nEvaluate and pilot new automation, orchestration, and AI tooling to expand the detection and response automation footprint.\nWhat we'll want you to have:\n5+ years building automation, orchestration, or SOAR playbooks in a cyber security or SOC environment.\n3+ years of SIEM engineering or administration experience - data onboarding, correlation rule development, platform configuration.\nStrong Python (or comparable scripting) skills; experience building APIs/integrations across security and IT tooling.\nHands-on experience with AI/ML or LLM-based tooling applied to security use cases - triage, summarization, enrichment, and/or anomaly detection; experience building such capability strongly preferred.\nWorking knowledge of MITRE ATT&CK and experience mapping detections/automation to adversary tactics and techniques.\nExperience with a SOAR or security orchestration platform (e.g., NG-SIEM Fusion, Splunk SOAR, Palo Alto XSOAR, Tines, or similar).\nCloud security experience (AWS, Azure, or GCP), including automation for ingesting and processing security data from cloud sources.\nExperience with CI/CD, infrastructure-as-code, and version-controlling detection/automation content.\nFamiliarity with containerized and serverless environments and their automation/logging considerations.\nSIEM, SOAR, or security automation platform certification preferred.\nRegulatory compliance experience a plus.\nStay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube\nBlackbaud powers social impact through purpose-driven technology and responsible AI. Guided by our Intelligence for Good® vision, we’re building a culture where innovation, trust, and human expertise come together to help organizations make a greater difference in the world.\nBlackbaud is proud to be an equal opportunity employer and is committed to maintaining a diverse and inclusive work environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law.\nThe starting base pay is $117,200.00 to $157,500.00. Blackbaud may pay more or less based on employee qualifications, market value, Company finances, and other operational considerations.Benefits Include:\nMedical, dental, and vision insurance\n\nRemote-flexible workforce\n\nWellness Programs\n\n401(k) program with employer match\n\nFlexible paid time off\n\nGenerous Parental Leave\n\nDonations for Doers\n\nPet insurance, legal and identity protection\n\nTuition reimbursement program","description_format":"text","description_chars":5197,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Parental leave","Vision insurance","Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Domain Registrars & Registries","EdTech Platforms","Payment Processing & Gateways","Nonprofit, Church & Membership Software"],"lifecycle":[{"event":"open","at":"2026-10-14T12:35:29Z"},{"event":"close","at":"2026-10-29T14:56:25Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2 · green card filings: 1","filings_12m":2,"filings_prev_12m":6,"green_card_filings_12m":1,"median_offered_wage_usd":127500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":null,"pay":{"stated_usd_annual":157500,"is_top_pay":false},"html_url":"https://alion.io/job/blackbaud-principal-security-engineer-orchestration-and-automation","json_url":"https://alion.io/job/blackbaud-principal-security-engineer-orchestration-and-automation.json","meta":{"generated_at":"2026-11-01T17:24:30Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26623,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":36535},"rest":"https://alion.io/mcp/rest/get_company?id=36535"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblackbaud-principal-security-engineer-orchestration-and-automation"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblackbaud-principal-security-engineer-orchestration-and-automation"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblackbaud-principal-security-engineer-orchestration-and-automation"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blackbaud-principal-security-engineer-orchestration-and-automation\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblackbaud-principal-security-engineer-orchestration-and-automation"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2529537}},{"tool":"search_jobs","arguments":{"company":"blackbaud.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2529537},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}