Security Automation Engineer (DevSecOps)

ECI • San Francisco, CA

6d

About The Position

The Security Automation Engineer is part of ECI's Security Engineering team and focuses on building and operating the automation layer that powers security services at scale. This hands-on engineering role emphasizes production Python, integration engineering, and reliable delivery. The engineer designs and maintains automation services, detection-as-code pipelines, and SOAR workflows integrated with the wider security platform. The role also uses AI-assisted workflows to improve delivery quality, reduce repetitive operational effort, and accelerate security outcomes across detection, response, and platform services.

Within the Automation function, the engineer builds and operates the code, workflows, and integrations that deliver detection and response outcomes. The role partners closely with Platform Engineering, which is accountable for the Elastic environment, Logstash estate, and core data pipelines supplying telemetry. Automation owns how workflows are engineered, tested, deployed, and maintained; Platform owns data ingestion, parsing standards, schema quality, and platform reliability.

Requirements

• Degree in Computer Science, Cyber Security, Engineering, or equivalent practical experience.
• At least 3 years of experience building and maintaining production Python applications, services, or automation systems.
• Strong software engineering fundamentals, including modular design, testing strategy, error handling, code review, and maintainable code structure.
• Experience building API integrations and automation workflows in production environments.
• Practical CI/CD experience with automated testing and controlled deployment workflows.
• Proficiency with Git and collaborative development practices.
• Working knowledge of Linux administration in engineering environments.
• Working knowledge of cloud platforms and services, including IAM, networking, and secure integration patterns in AWS, Azure, or GCP.
• Foundational understanding of detection and incident response concepts within security operations.
• Interest in AI-assisted engineering, emerging technologies, and modern engineering practices that improve delivery quality and efficiency.
• Interest in evolving security threats, cyber security trends, and the changing technology landscape.

Nice To Haves

• Experience with SOAR platforms and workflow orchestration in enterprise security environments.
• Experience with detection engineering in Elastic Security, Splunk, or Microsoft Sentinel.
• Familiarity with MITRE ATT&CK, Sigma, or detection-as-code practices.
• Experience integrating AI-assisted capabilities into operational workflows.
• Exposure to containerized deployment patterns with Docker or Kubernetes.
• Experience developing shared internal tooling used by multiple engineering teams.

Responsibilities

• Build and maintain production Python services, internal tooling, and reusable libraries for security automation.
• Build and operate detection-as-code workflows, including rule lifecycle, testing, versioning, and release controls.
• Develop and maintain SOAR workflows for investigation and response orchestration.
• Engineer robust integrations across internal systems and third-party tools using REST APIs, webhooks, and event-driven patterns.
• Build and maintain CI/CD pipelines, automated tests, and quality gates for automation and detection content.
• Contribute automation capabilities that support Platform-led client onboarding, offboarding, and technology enablement processes.
• Improve the reliability, observability, and maintainability of automation services through metrics, logging, alerting, and runbooks.
• Collaborate in architecture and code review practices to raise engineering standards across the function.
• Explore and apply AI-assisted engineering practices to improve automation quality, testing, documentation, and delivery efficiency.

What This Job Offers

• Job Type: Full-time