> Markdown version of [/jobs/ext/2663536-security-automation-engineer-soar-xsoar-davinsi-labs](https://www.wearedevelopers.com/jobs/ext/2663536-security-automation-engineer-soar-xsoar-davinsi-labs). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Automation Engineer (SOAR/XSOAR) | Davinsi Labs

- **Company:** Palo Alto Cortex Xsoar.
- **Location:** Berchem (Antwerpen), Belgium
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Microsoft Windows, Systems Engineering, Cyber Security, Linux, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Security Information and Event Management, Software Construction, Systems Integration, Scripting, Git, Enterprise Integration, Cortex XSOAR Platform, Software Version Control, Security Orchestration, Automation & Response
- **Published:** September 1, 2026
- **Apply:** https://europa.eu/eures/portal/jv-se/jv-details/YjNiMTA5MzAtYTRjYy00MGNiLWJiMmYtZmE1MTVjMmExMGJiIDM?lang=en

## About the Role

* You are passionate about IT security and automation, with several years of relevant professional experience.
 * You have hands-on experience with SOAR platforms, preferably Palo Alto Cortex XSOAR.
 * You are comfortable building response playbooks and automations end-toend.
 * You strongly believe in automation as code and have experience with Gitbased workflows.
 * Basic system engineering knowledge (Windows, Linux, networking, identity) is a plus.
 * You have experience integrating security platforms such as SIEM, XDR, EDR, IAM, or ITSM tools.
 * You understand security operations and incident response processes.
 * Experience with scripting (Python, JavaScript) is a strong plus.
 * You communicate smoothly in Dutch and English (written and oral). French is a plus.
 * You are analytical, structured, and not afraid to challenge existing processes to improve them.

## Description

Security Automation & Playbook Development

 * Design, build, and maintain response playbooks in Cortex XSOAR for common and advanced security incidents.
 * Translate detection alerts from SIEM and XDR platforms into automated investigation and response flows.
 * Implement conditional logic, enrichment steps, human-in-the-loop approvals, and automated containment actions.

SOAR as Code

 * Manage playbooks, integrations, scripts, and content packs using version control (Git).
 * Apply software engineering best practices such as modularity, reusability, testing, and peer review.
 * Contribute to standardized automation frameworks that can be reused across customers.

Platform Integrations

 * Build and maintain integrations between XSOAR and:
 + SIEM platforms o XDR / EDR solutions
 + ITSM tools (incident creation, updates, closures) o Identity, network, and cloud security controls
 * Troubleshoot and optimize integrations for reliability, performance, and scalability.

Incident Response Enablement

 * Collaborate closely with Detection Engineering and Incident Response teams to define:
 + Automated investigation steps o Response actions and containment strategies o Escalation and handover points to analysts
 * Continuously improve response quality based on real incident feedback.

Automation Lifecycle Management

 * Maintain and evolve our automation content library.
 * Tune playbooks to reduce noise, false positives, and manual


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture)
- [Git for Code Reviews](https://www.wearedevelopers.com/videos/429-git-for-code-reviews)

## Related Articles

- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Where To Find Software Engineering Jobs](https://www.wearedevelopers.com/magazine/396-where-to-find-software-engineering-jobs)
- [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)