> Markdown version of [/jobs/ext/4204709-cybersecurity-automation-engineer-soc-siem-soar](https://www.wearedevelopers.com/jobs/ext/4204709-cybersecurity-automation-engineer-soc-siem-soar). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cybersecurity Automation Engineer SOC SIEM/SOAR - **Company:** T-mobile - **Location:** Madrid, Spain (Remote available) - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Amazon Web Services, Automation of Tests, Microsoft Azure, Bash Shell, Unix, Cloud Computing, Cloud Computing Security, Cyber Security, Computer Programming, Linux, Domain Name System (DNS), Event Logging, Information Systems Security Architecture Professional, Python (Programming Language), Network Architecture, Network Forensics, Windows PowerShell, Anti-Phishing, Security Information and Event Management, Syslog, TCP/IP, Windows Desktop, Data Processing, Scripting, Google Cloud, Cyber Threat Analysis, Infrastructure Automation Frameworks, Cortex XSOAR Platform, Splunk, Event Viewer - **Published:** October 16, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=de13c5378bfabc57 ## About the Role We are seeking a Cybersecurity Automation Engineer with extensive experience in SOC operations, SIEM/SOAR platforms, and automation development. The ideal candidate will have strong technical knowledge in cybersecurity fundamentals, scripting languages, and cloud security, combined with excellent problem-solving and communication skills., * Spanish language proficiency * Middle English language proficiency * University education in technical or higher IT or telecommunications engineering or other similar technical qualification * Demonstrable experience of at least 3 years in the field of cybersecurity * At least 2 years of experience in a SOC or similar in functions similar to those of the position * Understanding of Security Principles: Confidentiality, Integrity, and Availability (CIA) * Knowledge about malware, phishing, denial of service (DoS) attacks, APTs (Advanced Persistent Threats), and TTPS (attack techniques and tactics) * Understanding the full lifecycle of incident management, from detection to remediation and post-incident reporting * Ability to quickly identify the nature of a security incident and take initial containment measures * Ability to delve into the technical details of an incident, using logs, network traffic analysis, and forensic analysis tools * Familiarity with cloud computing environments (AWS, Azure, GCP) * Experience in protecting cloud-based infrastructures and services * Understanding network architecture and topologies * Knowledge of common protocols such as TCP/IP, HTTP, HTTPS, DNS * Familiarity with Windows, Linux and Unix operating systems * Knowledge about event logging systems in different operating systems (Event Viewer on Windows, syslog on Linux) * Familiarity with SIEM tools * Understanding how record data is collected, normalized and stored * Ability to create and adjust correlation rules to detect attack patterns and suspicious activities * Ability to analyze alerts and events generated by SIEM, identify false positives and prioritize incidents * Experience with SOAR tools * Knowledge in creating and managing automatic playbooks and workflows to respond to security incidents * Ability to integrate multiple security tools and systems using SOAR to improve incident response * Ability to write scripts in Python to automate security tasks * Experience with scripting in Bash (for Linux systems) * Experience with scripting in PowerShell (for Windows systems) * Ability to interact with security tool APIs to integrate and automate workflows * Knowledge of how to automate repetitive tasks and workflows using scripting and automation tools * Ability to communicate effectively with other technical teams * Ability to write reports and documentation within the scope of their functions and tasks * Critical thinking ability to address and solve complex security problems * Ability to adapt to new threats and emerging security technologies, * High English language proficiency * Master's degree or specialization in cybersecurity or similar * Knowledge and experience in SPLUNK SIEM * Knowledge and experience in Azure Sentinel * Experience with SPLUNK SOAR * Experience with Palo Alto Cortex XSOAR * Experience with Palo Alto XSIAM * Experience with automation in Azure Sentinel ## Description * Perform SIEM configurations and use cases: Develop and implement complex configurations within the SIEM system to ensure optimal detection and response capabilities, including correlation rules, filters, and data source integrations * Development of automations and playbooks in the SOAR: Develop custom scripts or automation workflows to improve the automation capabilities of the SOAR platform, allowing for more efficient incident response and mitigation * Integration of SOC tools through APIs to automate and improve the efficiency and effectiveness of SOC processes * Scripting and programming development: scripting in languages such as Python, PowerShell or Bash to develop custom scripts for automation, integration and data manipulation * Optimization: Continuously adjusting and optimizing the SIEM/SOAR modules to improve their effectiveness over time, adapting to changes in the threat landscape and organizational needs * Collaboration with SOC teams, Cybersecurity Architecture, CuSM, and other IT teams: Work closely with IT and other security teams to understand the organization's infrastructure, applications, and network architecture, ensuring effective SIEM/SOAR integration