XSIAM Automation Engineer

Our Mission

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Who We Are

In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!

We believe collaboration thrives in person. That’s why most of our teams work from the office full time, with flexibility when it’s needed. This model supports real-time problem-solving, stronger relationships, and the kind of precision that drives great outcomes.

Job Summary

The Cortex XSIAM Automation Engineer is a highly specialized technical role within the Professional Services team. This individual is a critical component in unlocking the full potential of Palo Alto Networks' Cortex XSIAM platform for our customers. The role focuses on leveraging the platform's native SOAR (Security Orchestration, Automation, and Response) capabilities to build robust, automated workflows. This involves analyzing customer security processes, migrating playbooks from legacy SOAR platforms (including Cortex XSOAR), and developing new automations and integrations to streamline Security Operations Center (SOC) activities.

This position requires a deep understanding of SOC workflows, automation principles, and API integration, combined with hands-on expertise in developing playbooks and scripts within the Cortex XSIAM/XSOAR environment.

Your Impact

• Automation Strategy and Playbook Migration:

• Lead the analysis of customer's existing Standard Operating Procedures (SOPs), incident response workflows, and security processes to identify automation opportunities.

• Plan and execute the migration of automation playbooks from legacy SOAR solutions, including Cortex XSOAR, to Cortex XSIAM.

• Translate customer requirements and existing process logic into efficient and scalable XSIAM playbooks.

• Playbook and Integration Development:

• Design, develop, test, and deploy custom playbooks in XSIAM for various security use cases, such as incident triage, enrichment, and remediation.

• Develop and maintain custom scripts (typically in Python) and integrations to connect XSIAM with third-party security and IT tools.

• Implement automated incident handling, data enrichment from threat intelligence sources, and response actions.

• Orchestration and Process Optimization:

• Configure and manage integrations with a wide array of security tools to create a unified "single pane of glass" for incident response.

• Work with customer SOC teams to optimize and automate Level 1 analyst tasks, significantly reducing manual effort and response times.

• Implement complex automation workflows that may involve human-in-the-loop decision points and task-based assignments.

• Customer Enablement and Project Success:

• Act as the primary automation and orchestration expert within the project team, collaborating with the XSIAM Lead Consultant, SIEM Engineer, and Endpoint Engineer.

• Contribute automation-specific content to key project documents, such as Solution Design and As-Built documents.

• Provide expert guidance and best practices on automation, scripting, and playbook development to customer teams.

• Assist in the final testing, validation, and transition of automated workflows to the customer for Business-As-Usual (BAU) operations.

Qualifications

**

Your Experience

- Technical Skills:

• Proven experience with SOAR platforms such as Cortex XSOAR (highly preferred), Splunk SOAR, or other similar solutions.

• Strong proficiency in Python scripting for the purpose of developing automation scripts and custom integrations.

• Hands-on experience developing, testing, and deploying automation playbooks for security operations.

• Deep understanding of SOC processes, incident response lifecycle, and common analyst workflows.

• Familiarity with REST APIs for integrating various security technologies.

• Experience with ThreatIntelligence Management (TIM) platforms and automating threat intelligence workflows is a plus.

• Professional Attributes:

• Experience in a customer-facing, consultative role within professional services, solutions architecture, or a senior SOC engineering capacity.

• Strong problem-solving skills with the ability to analyze complex manual processes and re-engineer them into automated workflows.

• Excellent communication skills, capable of explaining complex automation concepts to both technical and non-technical stakeholders.

• A collaborative mindset, with the ability to work effectively within a multi-disciplinary project team to ensure successful customer outcomes.

Our Commitment **

We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at  mailto:[email protected]?subject=Accommodation%20Assitance [email protected].

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.

Is role eligible for Immigration Sponsorship? No. Please note that we will not sponsor applicants for work visas for this position.