> Markdown version of [/jobs/ext/3991322-security-automation-consultant](https://www.wearedevelopers.com/jobs/ext/3991322-security-automation-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Automation Consultant - **Company:** Entelligence LLC - **Location:** United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), ARM Architecture, Authentication Protocols, Cloud Computing Security, CompTIA Security+, Cyber Security, Data Validation, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Parsing, Runbook, Security Log, Security Information and Event Management, Scripting, Mitre Att&ck, Software Troubleshooting, QRadar, Cyber Threat Analysis, Cybercrime, Microsoft Sentinel, Cortex XSOAR Platform, Splunk, Security Orchestration, Automation & Response - **Published:** October 28, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9270761/security-automation-consultant ## About the Role * 5+ years of experience in SIEM engineering, detection engineering, security engineering, security operations, or a related cybersecurity discipline * Hands-on experience engineering SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, Elastic, Cortex XSIAM, or similar technologies * Experience onboarding log sources, validating security telemetry, parsing data, and normalizing security events * Experience developing and tuning correlation rules, detection content, hunting queries, and security analytics * Experience analyzing false positives and improving detection quality and threat coverage * Strong understanding of SOC operations, incident response, threat detection, and security analytics * Python or scripting experience supporting security engineering, automation, data validation, enrichment, or analyst workflows * Experience integrating enterprise security technologies using APIs and other platform interfaces * Understanding of Linux/Unix systems, networking, authentication protocols, and enterprise security architectures * Strong troubleshooting, analytical, and problem-solving skills * Excellent communication skills with the ability to work directly with enterprise customers and technical stakeholders, * Experience working in cybersecurity consulting, professional services, MSSP, or other customer-facing security engineering environments * Experience implementing, deploying, or optimizing SIEM/security platforms across multiple customer environments * Experience with Cortex XSIAM, Cortex XSOAR, or other Palo Alto security technologies * Experience with Splunk Enterprise Security, Microsoft Sentinel, QRadar, or Elastic * Experience with MITRE ATT&CK-based detection engineering and threat-informed defense * Experience with detection-as-code methodologies, version-controlled detection content, or CI/CD pipelines * Experience with threat hunting and threat intelligence integration * Experience integrating EDR, IAM, ITSM, cloud security, and other enterprise security platforms * Experience with SOAR, security orchestration, playbooks, and security automation * CISSP, GIAC/SANS, Security+, or related cybersecurity certifications ## Description * Design, implement, and optimize SIEM and security analytics solutions across enterprise customer environments * Onboard, integrate, and validate security log sources and telemetry from cloud, endpoint, network, identity, and other security technologies * Develop and tune detection content, correlation rules, hunting queries, and security analytics * Normalize, parse, map, and validate security data to ensure accurate and reliable detection capabilities * Analyze false positives and tune detections to improve alert fidelity and signal-to-noise ratio * Identify detection gaps and develop threat-informed detection coverage * Develop Python-based tooling and automation to support detection engineering, log validation, enrichment, and SOC workflows * Integrate SIEM, SOAR, EDR, threat intelligence, identity, ITSM, and other cybersecurity platforms * Partner directly with customers and SOC teams to understand security requirements and improve detection and investigation capabilities * Support the deployment, configuration, integration, and optimization of Cortex and other enterprise security platforms * Develop dashboards, reporting, technical documentation, runbooks, and engineering standards * Present technical findings, recommendations, and solutions to technical and non-technical stakeholders