{"id":186388,"url":"https://alion.io/job/mastercard-lead-response-technology-and-automation-security-engineer","title":"Lead Response Technology and Automation Security Engineer","company":{"id":252,"name":"Mastercard","domain":"mastercard.com","url":"https://alion.io/company/mastercard","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":94,"open_postings":254,"ghost_share":0.016,"stale_share":0.358,"repost_share":0.094,"time_to_fill_p50_days":21,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pune, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":26000,"max_usd":58000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Okta","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"CI/CD","optional":true}],"status":"live","first_seen_at":"2026-09-01T17:50:39Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-18T15:43:03Z","board_verified":true,"closed_at":null,"days_open":47,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":47},"description":"Our Purpose\nMastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.\nTitle and Summary\nLead Response Technology and Automation Security EngineerOverviewThe Corporate Security Threat and Response Management product ownership team is looking for a Lead Level Security Engineer to help drive our Security Operations modernization strategy. The ideal candidate is passionate about the modern security tools, capabilities, and strategies.\nThe RESPOND product team executes on the multi-year strategy and roadmap set by the RESPOND product owner to evolve and modernize SecOps incident investigation and response technology, capabilities, tools, and process.\nResponse product team members work closely with regional SOC teams to execute the RESPOND product strategy on the ground. This role is the connective tissue between product vision and operational reality: building, tuning, and operationalizing response automation, AI-augmented workflows, and analyst tooling that SOC and DFIR teams rely on every day. The RESPOND product team is hands-on with SOAR development, agentic AI integration, notebook-based investigation tooling, and continuous improvement of analyst workflows.\nCore Responsibilities\nExecute the RESPOND product roadmap in close partnership with SOC and Incident Response teams in the region.\nDesign, build, test, and maintain SOAR playbooks used for incident triage and response scopes to collect and process digital evidence and artifacts at speed and scale.\nBuild and operationalize AI-augmented response capabilities, including:\no Agentic AI workflows integrated into triage, enrichment, and response.\no Prompt books and prompt libraries tuned for SOC and Incident Response use cases.\no Prompt-book/code notebook (Jupyter, etc) development for repeatable investigation, hunt, and DFIR workflows.\no LLM-driven enrichment and summarization integrated into case management.\nDefine strategic requirements and oversee management for connectors, apps, and integrations between SOAR, SIEM, EDR, identity, ticketing, threat intelligence, and AI/LLM platforms (including MCP servers where applicable) for build through our dedicated engineering partners.\nBuild and maintain response tooling: scripts, live-response packages, enrichment services, and automation utilities deployable via EDR and SOAR.\nEmbed with SOC and DFIR analysts to identify high-toil workflows and convert them into automated, AI-assisted, or fully autonomous playbooks with appropriate guardrails.\nTune and optimize playbooks and AI-assisted workflows against measurable outcomes (MTTR, false-positive rate, analyst touch time, AI-assist accuracy).\nContribute to the centralized response tooling, prompt book, and notebook libraries, ensuring code quality, documentation, version control, and reusability across regions.\nSupport major incident response activities by deploying and operating response tooling and AI-assisted investigation workflows under pressure.\nProvide feedback into the product backlog and partner with the PO on requirements refinement.\nDocument playbooks, prompt books, notebooks, and technical designs to enterprise standards.\nAll About you\n5+ years in security operations, incident response, detection engineering, or security automation engineering\nPrior experience as a SOC analyst, Security Engineer, Digital Forensics Examiner, SOAR engineer, and/or threat hunter preferred.\nHands-on SOAR development experience with low-code/no-code or hyper-automation tools and concepts. Must be able to define and build reliable, scalable response capabilities.\nDemonstrated enterprise experience executing on AI-augmented SOC concepts, including at least two of:\no Building and maintaining AI prompt books for analyst workflows.\no Developing Jupyter notebooks for investigation, hunt, or DFIR.\no Integrating LLMs or agentic AI into XDR, SOAR, case management, or response tooling.\no Leveraging IDEs with AI connectors to process data and execute AI workflows\no Deploying agent-based AI workflows for triage or enrichment in production.\nStrong scripting skills in Python and PowerShell. Comfortable with basic code repo management using Git or equivalent.\nWorking knowledge of REST APIs, JSON, webhooks, and authentication patterns (OAuth, API keys, managed identities).\nSolid grounding in incident response fundamentals and the IR lifecycle.\nHands-on experience with: EDR platforms (CrowdStrike, SentinelOne, Defender for Endpoint), SIEM (Splunk ES, Microsoft Sentinel), identity platforms (Entra ID, Okta), cloud platforms (AWS, Azure, GCP), and cloud protection products (CNAPP, CWPP, CSPM).\nFamiliarity with MITRE ATT&CK and the ability to map response actions to adversary techniques.\nDemonstrated ability to operate inside an agile delivery model with a product backlog.\nPreferred Qualifications\nBachelor’s degree in computer science, cybersecurity, or IT-focused disciplines (or equivalent experience).\nAt least two Industry certifications: GCFA, GCIH, GNFA, GCFR, GREM, or equivalent.\nExperience with SecOps focused MCP server architectures, agentic frameworks, or tools\nExperience building EDR live-response scripts and tool libraries.\nExposure to detection-as-code and response-as-code practices, including CI/CD for security content.\n• Background in regulated financial services or Fortune 500 SOC environments.\nCorporate Security Responsibility\nAll activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:\nAbide by Mastercard’s security policies and practices;\n\nEnsure the confidentiality and integrity of the information being accessed;\n\nReport any suspected information security violation or breach, and\n\nComplete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.","description_format":"text","description_chars":6355,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cards & Card Issuing","Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-09-01T17:50:39Z"}],"visa":[],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.614,"p_room":0.28,"age_days":45,"expected_fill_days":21,"reasons":["conf:1","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/mastercard-lead-response-technology-and-automation-security-engineer","json_url":"https://alion.io/job/mastercard-lead-response-technology-and-automation-security-engineer.json","meta":{"generated_at":"2026-10-18T17:58:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22841,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":252},"rest":"https://alion.io/mcp/rest/get_company?id=252"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmastercard-lead-response-technology-and-automation-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmastercard-lead-response-technology-and-automation-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmastercard-lead-response-technology-and-automation-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mastercard-lead-response-technology-and-automation-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmastercard-lead-response-technology-and-automation-security-engineer"}]}