Job Description & Details
This is a hands-on contracting gig focused heavily on bridging the gap between security operations and automation. If you are tired of drowning in manual alerts and want to spend your days actually building playbooks and fixing systemic pipeline issues with Python, this one is worth a look. You will be acting as the technical engine room for incident response, making sure analysts aren't wasting time on repetitive triage.
What You'll Actually Be Doing
Your day will be a mix of writing Python scripts, architecting and refining XSOAR playbooks, and diving into Splunk logs to trace down weird anomalies. You are not just writing code in a vacuum; you will be sitting right next to the incident response team, figuring out where their workflows stall out and automating those bottlenecks away. Expect to investigate active events, analyze root causes, and turn messy manual procedures into slick, repeatable automated pipelines.
The Core Tech Stack
To survive here, you need to be dangerous with Python, Palo Alto XSOAR, and Splunk. The team relies on XSOAR as the central nervous system for orchestration, so if you haven't built complex playbooks from scratch or integrated custom APIs, you'll hit a wall fast. Splunk is your source of truth for threat detection and telemetry, so deep query skills are non-negotiable. Bonus points if you've touched CrowdStrike, Proofpoint, or Azure, but the core triad of Python, XSOAR, and Splunk is what actually moves the needle for them.
Interview Expectations
They are going to test your practical engineering chops, not just your theory. Expect a scenario where they drop a messy incident response workflow on you and ask how you would break it down into an automated XSOAR playbook using Python. The interviewer is secretly looking to see if you understand the operational friction points in a SOC, rather than just writing syntactically correct code. They also love asking about edge cases in asynchronous API calls or how you handle error states when a third-party security tool goes down mid-playbook.
Application Advice
Skip the generic cybersecurity fluff on your resume and put your automation projects front and center. Highlight specific XSOAR integrations you've built, complex playbooks you've designed, and measurable metrics like 'reduced MTTR by 40% through automated phishing triage.' Make sure keywords like 'Palo Alto XSOAR', 'Splunk', 'Python', and 'Incident Response' are baked naturally into your bullet points so you easily clear the ATS filters before a human engineer actually reads your background.