Lead Security Automation Consultant (SOAR / Azure) (copy)

Trility Consulting

6d•Remote

About The Position

Trility Consulting is seeking a senior-level Lead Security Automation Consultant for a short-term client engagement focused on building and implementing security automation workflows and integrations. The role is hands-on and involves translating defined requirements into reliable, reusable automation solutions across platforms including Tines, Microsoft Azure, ServiceNow, and other security tools. The engagement is approximately six weeks, starting mid-December 2026 and running through late January 2027. It is a remote 1099 contract position.

Requirements

At least 5 years of experience in security engineering, security automation, systems integration, or a related technical discipline.
Hands-on experience designing and implementing security automation or workflow automation solutions.
Strong Python development experience, including building and deploying Azure Functions.
Experience writing and working with Kusto Query Language (KQL), particularly Microsoft Defender advanced hunting.
Experience integrating ServiceNow with security platforms or other enterprise applications.
Strong experience building and consuming REST APIs and developing application integrations.
Experience with Microsoft Graph and Microsoft Entra ID, including automating group membership changes and working with application registration credentials.
Experience implementing Azure DevOps pipelines to deploy Azure Functions.
Experience working within structured change-control and approval processes.
Experience with a security orchestration or workflow automation platform such as Tines, Torq, Swimlane, Splunk SOAR, Cortex XSOAR, or Microsoft Sentinel Playbooks/Azure Logic Apps.
Ability to independently develop, troubleshoot, and deliver working automation solutions within a defined project timeline.
Strong problem-solving, communication, documentation, and knowledge-sharing skills.
Must reside within the United States.
Must be authorized to work in the United States without sponsorship now or in the future.
Must be able to pass a background check.

Nice To Haves

Direct, hands-on experience with Tines.
Experience with Microsoft Sentinel and Sentinel playbooks.
Experience with Defender for Office 365 or Proofpoint email and click data.
Experience working with Tenable and Common Vulnerabilities and Exposures (CVE) data.
Experience integrating or working with the Hunters security platform.
Familiarity with n8n, Power Automate, Workato, or other workflow automation platforms.
Experience building security triage, ticketing, and case-management workflows.
Experience working in a consulting or professional services environment.

Responsibilities

Design, develop, and implement security automation workflows for defined client use cases.
Build integrations between security platforms, ServiceNow, and other enterprise applications using REST APIs and Microsoft Graph.
Develop and maintain Python-based Azure Functions for automation and integration requirements.
Build and use KQL queries, particularly Microsoft Defender advanced hunting, to retrieve, filter, and analyze security data.
Develop automated workflows using Tines or comparable security orchestration and automation platforms.
Integrate security alerts, incident data, and case-handling processes with ServiceNow.
Use Microsoft Entra ID for identity-related automation, including group membership changes and application registration credentials.
Implement Azure DevOps pipelines to deploy Azure Functions and support controlled release processes.
Follow client change-control and approval processes to ensure changes are reviewed, tested, and deployed appropriately.
Troubleshoot, test, and optimize automation workflows and integrations for reliability.
Build reusable components, develop supporting runbooks, and lead knowledge-transfer sessions with the client's engineer.
Collaborate with client stakeholders to understand requirements and translate them into practical automation solutions.