> Markdown version of [/jobs/ext/2721350-xsiam-automation-consultant](https://www.wearedevelopers.com/jobs/ext/2721350-xsiam-automation-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # XSIAM Automation Consultant - **Company:** Exl Neo Technologies - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** JavaScript (Programming Language), Application Programming Interfaces (APIs), Amazon Web Services, ARM Architecture, JIRA, User Authentication, Automation of Tests, Microsoft Azure, Cloud Computing, Cyber Security, Data Transformation, Software Design Documents, High-Level Architecture, Intrusion Detection and Prevention, JSON, Python (Programming Language), OAuth, ArcSight SIEM Tool, Phishing, Runbook, Security Information and Event Management, Data Streaming, Systems Integration, Extensible Markup Language (XML), Google Cloud, Power Platform Integration, Mitre Att&ck, QRadar, Cyber Threat Analysis, Information Technology, Cybercrime, Palo Alto Networks, Enterprise Integration, Cortex XSOAR Platform, Restful APIs, Splunk, Webhooks, Security Orchestration, Automation & Response, Servicenow - **Published:** September 4, 2026 - **Apply:** https://www.dice.com/job-detail/1087659d-7dfd-46d4-833c-38339ca8a421 ## About the Role 5 - 12 years of experience in cybersecurity, security operations, security automation, SOAR, or Professional Services. Strong hands-on experience with Cortex XSOAR and/or Cortex XSIAM. Proven experience designing and implementing SOC automation workflows. Strong proficiency in Python. Strong knowledge of REST APIs, JSON, OAuth, API tokens, and webhooks. Experience developing custom integrations or connectors. Strong understanding of: Security Operations Incident Response Threat Intelligence SOC workflows Security automation Experience integrating security platforms and enterprise IT systems. Ability to create and interpret technical design documentation. Strong troubleshooting and problem-solving skills. Excellent written and verbal communication skills. Prior customer-facing consulting or Professional Services experience. Preferred Qualifications Hands-on experience with Cortex XSIAM. Experience with Cortex XDR. Experience with other SOAR platforms such as: Splunk SOAR / Phantom IBM Resilient Swimlane Tines Experience with enterprise SIEM platforms such as: Splunk QRadar ArcSight NetWitness Experience with ServiceNow and Jira. Experience with cloud platforms such as AWS, Azure, or Google Cloud Platform. Knowledge of MITRE ATT&CK. Experience with threat intelligence platforms. Experience developing custom security integrations., CISSP, CISM, GIAC, or relevant cloud/security certifications. The broader XSOAR/SIEM JD supports including SIEM, detection engineering, threat hunting, cloud platforms, and security certifications as preferred areas rather than making them mandatory. Key Competencies Cortex XSIAM/XSOAR expertise Security automation and orchestration Playbook design and development Python development API and integration development SOC process optimization Incident response Structured problem-solving Enterprise security architecture Customer consulting Technical documentation Technical presentations and knowledge transfer Ability to work independently in customer environments ## Description We are seeking a Professional Services Consultant - XSIAM Automation to join our cybersecurity Professional Services team. This is a hands-on, customer-facing technical consulting role focused on designing, implementing, and optimizing security automation and orchestration solutions using Palo Alto Networks Cortex XSIAM and Cortex XSOAR. The consultant will work with enterprise customers to assess SOC processes, identify automation opportunities, design and develop production-grade playbooks, build custom integrations, and operationalize security workflows. The role combines the technical depth of a Security Automation Engineer with the customer-facing responsibilities of a Professional Services Consultant. The ideal candidate should be equally comfortable discussing automation strategy with a customer's SOC team and writing Python code to implement a complex integration or automation workflow. Key Responsibilities 1. XSIAM / XSOAR Administration Configure integrations, content packs, roles, permissions, and automation components. Design scalable and maintainable automation architectures aligned with customer requirements. Perform platform health checks and troubleshoot deployment, integration, and automation issues. Support platform upgrades, maintenance, and ongoing optimization. Validate end-to-end data flow, API connectivity, authentication, and workflow execution. 2. Automation & Playbook Development Design, develop, test, and maintain production-grade automation playbooks. Automate SOC processes across: Alert triage Investigation IOC enrichment Threat intelligence Phishing response Containment Remediation ITSM ticketing Analyze manual SOC processes and transform them into scalable automated workflows. Apply best practices for modularity, error handling, approvals, exception handling, auditability, and reusability. Optimize playbooks for performance, maintainability, and operational effectiveness. Manage and deploy content packs, automation assets, dashboards, and custom layouts. 3. Custom Integration & Automation Development Develop custom integrations and automation using Python and, where applicable, JavaScript. Build custom connectors when out-of-the-box integrations are unavailable. Integrate XSIAM/XSOAR with third-party security and IT platforms. Work with: REST APIs JSON XML OAuth API tokens Webhooks Troubleshoot API connectivity, authentication, data transformation, and integration issues. Develop reusable automation components to support customer-specific security workflows. The emphasis on custom connectors, Python/JavaScript, REST APIs, OAuth, JSON, and webhooks is drawn from the EE-XSOAR Automation requirements. 4. Security Operations & Automation Strategy Assess customer SOC processes and identify opportunities for automation. Translate manual security operations processes into automated workflows. Develop automation strategies aligned with customer security objectives. Design workflows covering incident enrichment, investigation, response, and remediation. Work with SOC teams to improve analyst efficiency and reduce repetitive manual activities. Apply knowledge of incident response, threat intelligence, and security operations best practices. Leverage frameworks such as MITRE ATT&CK where appropriate., Conduct customer discovery and requirements-gathering workshops. Understand existing SOC processes, challenges, and automation requirements. Translate business and technical requirements into practical automation solutions. Present solution designs, recommendations, implementation approaches, and trade-offs. Serve as a technical advisor to customer SOC teams and security stakeholders. Identify opportunities to improve security operations through automation and orchestration. 7. Demonstrations, Training & Knowledge Transfer Demonstrate playbooks, integrations, dashboards, and automation workflows to customer stakeholders. Conduct administrator and analyst training. Deliver technical workshops and enablement sessions. Develop knowledge-transfer materials to help customers manage and expand their automation environment. Support transition of implemented solutions into customer operations. 8. Documentation Create and maintain: High-Level Design (HLD) documents Low-Level Design (LLD) documents Architecture diagrams Integration documentation Playbook design documentation Runbooks Deployment procedures As-built documentation Operational procedures Maintain clear documentation of dependencies, configurations, workflows, and customer-specific requirements. ## Related Videos - [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray) - [AX is the only Experience that Matters](https://www.wearedevelopers.com/videos/1404-ax-is-the-only-experience-that-matters) - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Collaboration Quantified: Lessons from Open Source Developer Networks](https://www.wearedevelopers.com/videos/1422-collaboration-quantified-lessons-from-open-source-developer-networks) - [Introducing JSON Structure](https://www.wearedevelopers.com/videos/100219-introducing-json-structure) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift)