SOAR Developer - Assistant Manager

Role Overview:

 As part of Tata Communications MSS Engineering Team, the SOAR Engineer plays a critical role in SOAR workflows to improve incident response efficiency and reduce mean time to detect/respond (MTTD/MTTR). The role involves designing, developing and maintaining SOAR Playbooks, integrating security tools and collaborating with SOC and TH to streamline operations and enhance threat response capabilities.

key Responsibilities:

* Design and implement automated workflows for incident response, TI enrichment and alert triage.

* integrate SOAR platform with various security tools (SIEM, EDR, TI Feeds, Ticketing System, etc..)

* collaborate with TH and SOC Teams to identify automation opportunities and improve detection to response lifecycle.

* Develop custom scripts and connectors to extend SOAR capabilities (Python preferred).

* Maintain and optimize existing playbooks based on evaluating threat landscape and operational feedback.

* Ensure playbooks align with MITER ATT&CK framework and organizational threat models.

* Monitor SOAR platform performance and troubleshoot integration issues.

* Document playbooks, workflows and automation logic for operational transparency and audit readiness.

* conduct periodic reviews of automation effectiveness and recommend improvements.

Required Skills & Experience:

* 3+ years of experience in cybersecurity operations with at least 1-2 years in SOAR engineer or automation.

* hands-on experience with SOAR platforms(e.g., palo alto Cortex, XSOAR, Splunk Phantom, IBM Resilient, etc)

* Familiarity with REST API's JSON and data parsing.

* Understanding of incident response workflow and threat detection mythologies.

* Knowledge of MITER ATT&CK, NIST and other cybersecurity frameworks.

* Experience working with ticketing system(e.g, SNOW, JIRA).

* Strong analytical and problem-solving skills.

* Ability to work independently and collaboratively in fast-paced environment.

Preferred Qualifications:

* Certifications: Palo Alto XSOAR Certified, Splunk SOAR, CEH CHFL, or equivalent.

* Experience with threat intelligence platforms and enrichment techniques.

* Exposure to cloud security automation (AWS, Azure, GCP).

• * Experience in developing KPIs and metrics for automation effectiveness.