Solution Architect - Security Investigations, SIEM

Job Summary

Senior AI & Automation Engineer - Cyber Security & Security Operations

Key Responsibilities

Security Automation Engineering

• Design, develop, and maintain enterprise security automation solutions.
• Identify repetitive security activities suitable for automation.
• Build reusable automation frameworks and playbooks.
• Automate security investigations and remediation workflows.
• Develop Infrastructure-as-Code and Security-as-Code capabilities.
• Standardize security operations across global environments.
• Drive continuous improvement through automation and AI. ________________________________________ Security Operations (SOC) Automation Develop and maintain automation for:
• Incident triage
• Security alert enrichment
• Threat intelligence collection
• Malware response
• Phishing investigations
• Endpoint response
• Privileged access reviews
• Compliance validation Design workflows that:
• Reduce analyst workload
• Improve Mean Time to Detect (MTTD)
• Improve Mean Time to Respond (MTTR)
• Increase investigation consistency
• Minimize false positives ________________________________________ Microsoft Security Platform Design and automate solutions across: Microsoft Sentinel
• Incident automation
• SOAR playbooks
• Threat hunting workflows
• Alert enrichment
• Automated investigations
• Security dashboards Microsoft Defender Suite
• Defender XDR
• Defender for Endpoint
• Defender for Identity
• Defender for Cloud Apps
• Defender for Office 365
• Defender for Cloud Microsoft Entra ID
• Identity Governance
• Privileged Identity Management (PIM)
• Conditional Access
• Access Reviews
• Identity Lifecycle Automation Microsoft Purview
• Data Loss Prevention
• Information Protection
• Compliance automation
• Data classification ________________________________________ AI-Powered Security Operations Build and support:
• AI-driven threat detection
• Security Copilot integrations
• Copilot Studio security agents
• Automated threat analysis
• AI-assisted incident response
• Security knowledge assistants
• Security operations chatbots Develop solutions that:
• Accelerate investigations
• Improve threat correlation
• Reduce manual analysis
• Support proactive threat hunting ________________________________________ ServiceNow Security Operations Develop and optimize:
• Security Incident Response workflows
• Vulnerability Response processes
• Risk Management workflows
• Change Risk Assessment
• Security Governance integrations Integrate ServiceNow with:
• Microsoft Sentinel
• Microsoft Defender
• Vulnerability scanners
• CMDB platforms
• Identity systems
• SIEM/SOAR tooling ________________________________________ Red Hat Ansible Security Automation Develop automation for:
• Server hardening
• Security configuration compliance
• Vulnerability remediation
• Patch deployment
• Security baseline validation
• Certificate lifecycle management Manage and maintain:
• Ansible playbooks
• Automation repositories
• Configuration standards
• Compliance frameworks The broader automation strategy highlights the use of industrialised automation through technologies such as Ansible, PowerShell, standardised patterns, and governed delivery processes. ________________________________________ Vulnerability & Compliance Automation Drive automation initiatives related to:
• Vulnerability scanning
• Patch compliance
• Configuration drift detection
• Security benchmarks
• Regulatory compliance monitoring
• Audit evidence collection Support frameworks such as:
• ISO 27001
• NIST
• CIS Controls
• SOC2
• Corporate cyber security standards ________________________________________ Security Engineering & DevSecOps Support and automate:
• Security controls validation
• CI/CD security integrations
• Infrastructure compliance checks
• Secrets management
• Certificate management
• Application security workflows Implement:
• Security guardrails
• Automated approvals
• Security policy enforcement
• Compliance monitoring ________________________________________ Required Technical Skills Microsoft Security Stack Strong experience with:
• Microsoft Sentinel
• Microsof

Skill Requirements

Preferred Certifications Microsoft

• Microsoft Certified Cybersecurity Architect Expert
• Microsoft Security Operations Analyst
• Microsoft Identity and Access Administrator Security
• CISSP
• CISM
• GIAC Certifications
• Security+ Automation
• Red Hat Certified Specialist in Ansible Automation
• Microsoft Power Platform Certifications ServiceNow
• ServiceNow Certified System Administrator
• ServiceNow Security Operations Specialist ________________________________________ Success Metrics Within the first 12 months, you will:
• Reduce manual security operations workload.
• Automate high-volume security investigations.
• Decrease security incident response times.
• Improve vulnerability remediation speed.
• Improve compliance reporting accuracy.
• Deploy AI-driven security assistants.
• Increase automation coverage across security domains.
• Improve audit readiness and evidence collection.
• Reduce security operational costs.
• Implement measurable Security-AIOps capabilities.

Other Requirements

Required Qualifications Education

• Bachelor's degree in Cyber Security, Computer Science, Engineering, Information Technology, or equivalent experience. Experience
• 5+ years within Cyber Security, Security Engineering, Security Operations, or Security Automation.
• Experience working in enterprise-scale security environments.
• Experience building automation and orchestration workflows.
• Experience integrating Microsoft security technologies with ServiceNow.
• Experience developing scripts and security automation solutions.