Security Automation Engineer
About The Position
Pretium Enterprise Services (PES) is seeking a Security Automation Engineer to build and operate integrations, response workflows, and security platform controls supporting its operating companies. This is a hands-on, senior-level individual contributor role with no direct reports. The engineer will improve managed detection and response (MDR), reduce manual operational work, and make security services repeatable and reliable across environments. The scope includes endpoint, email, web, and private-access security, with shared workflows coordinated with identity, cloud, and AI security engineers. The role is hybrid, with three days a week in the Scottsdale, Arizona office as the preferred location. Dallas, Texas; Charlotte, North Carolina; and California are also locations that will be considered. Pretium Enterprise Services provides business services to its global operating companies, partnering with internal and external businesses and stakeholders to unlock customer value and enable scalable growth. The company describes its work environment as collegial and entrepreneurial, and is committed to team members' personal and professional growth and a positive, encouraging workplace.
Requirements
- Senior-level security engineering experience, with demonstrated ownership of production integrations and automation from design through ongoing support.
- Ability to diagnose problems independently and deliver verified improvements.
- Bachelor's degree in Computer Science, Cybersecurity, or a related area; the degree requirement is truncated in the posting after “I”.
- Strong Python or PowerShell skills and practical experience with REST APIs, webhooks, and JSON.
- Ability to troubleshoot authentication, permissions, rate limits, and integration failures across security platforms.
- Hands-on experience building and operating SOAR or equivalent response automation, including testing, error handling, monitoring, auditability, and recovery; experience must extend beyond configuring notifications or forwarding alerts.
- Practical incident-response experience and sound judgment about containment impact, service dependencies, and when human approval is required.
- Ability to validate that automated actions achieved the intended outcome.
- Experience engineering endpoint security and at least one additional domain such as email, web, identity, or network security, with the ability to learn and integrate unfamiliar products.
- Ability to manage automation through version control, peer review, and controlled releases, with secure credential handling and least-privilege access.
- Experience troubleshooting telemetry and control-coverage gaps, working with MDR or SOC teams, and driving technical issues to resolution with vendors and internal owners.
- Clear documentation and communication skills, including the ability to explain operational tradeoffs, influence independent teams, and transfer knowledge to other engineers.
Nice To Haves
- Experience with enterprise EDR/XDR, MDR, SOAR, or secure-access platforms.
- Experience in shared-services or multi-tenant environments.
- Experience with cloud-hosted automation, infrastructure as code, or detection validation.
- Relevant certifications or experience with equivalent technologies.
Responsibilities
- Assess security platform configurations, integration health, and recurring manual work; prioritize an engineering roadmap with the Director of Cybersecurity based on risk, operational effort, and business impact.
- Design, build, and maintain SOAR workflows for investigation, enrichment, containment, and remediation using native platform capabilities and custom code where appropriate.
- Engineer integrations across endpoint, email, secure-access, identity, logging, and ticketing platforms through APIs, webhooks, and supported connectors.
- Own security platform configuration standards and integration reliability; identify telemetry gaps, unhealthy agents, expired credentials, and failed jobs, and automate recovery or route actionable exceptions to the responsible team.
- Build and validate automated containment and remediation workflows, defining action scope, exclusions, approval thresholds, and recovery procedures with service owners.
- Build production automation with least-privilege service access, secure secrets handling, input validation, retries, duplicate-event handling, audit logs, and failure alerts; test changes and stage deployments before broad rollout.
- Validate MDR telemetry coverage, response permissions, and escalation paths; work with the provider to resolve gaps and verify contracted response actions in each supported environment.
- Exercise detection-to-response workflows through controlled testing, validate containment outcomes, and turn incident lessons and recurring failures into engineering improvements.
- Create reusable configurations, integration patterns, and acceptance checks for operating-company onboarding; maintain separation of credentials, data, and response scope across tenants and operating companies.
- Partner with IAM, cloud, and AI security engineers on cross-platform workflows while respecting their ownership of domain controls; coordinate endpoint and network changes with responsible IT teams.
- Document runbooks and support procedures, mentor engineers, and train operational backups.
- Track automation success, failure rates, response times, coverage, and reductions in manual effort.
Benefits
- 401(k) plan with an employer match.
- Health, dental, vision, and life insurance.
- Paid Time Off (PTO).
- 11 firm holidays.
- Hybrid office/work-from-home arrangement.
- Eligible for an annual year-end bonus.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
