Security Automation Engineer

Pretium Enterprise Services • Scottsdale, AZ

2d • Hybrid

About The Position

Pretium Enterprise Services (PES) is seeking a Security Automation Engineer to build and operate integrations, response workflows, and security platform controls supporting its operating companies. This hands-on, senior-level individual contributor role has no direct reports. The engineer will improve managed detection and response (MDR), reduce manual operational work, and make security services repeatable and reliable across environments. The scope includes endpoint, email, web, and private-access security, with shared workflows developed alongside identity, cloud, and AI security engineers.

The position is hybrid, three days per week in the Scottsdale, Arizona office (preferred). Dallas, Texas; Charlotte, North Carolina; and California are also considered locations.

Requirements

• Senior-level security engineering experience, including demonstrated ownership of production integrations and automation from design through ongoing support.
• Ability to independently diagnose problems and deliver verified improvements.
• Bachelor's degree in Computer Science or Cybersecurity.
• Strong Python or PowerShell skills and practical REST API, webhook, and JSON experience.
• Ability to troubleshoot authentication, permissions, rate limits, and integration failures across security platforms.
• Hands-on experience building and operating SOAR or equivalent response automation, including testing, error handling, monitoring, auditability, and recovery; experience must extend beyond configuring notifications or forwarding alerts.
• Practical incident-response experience and sound judgment about containment impact, service dependencies, and when human approval is required.
• Ability to validate that automated actions achieved the intended outcome.
• Experience engineering endpoint security and at least one additional domain such as email, web, identity, or network security, and ability to learn and integrate unfamiliar products.
• Ability to manage automation through version control, peer review, and controlled releases, with secure credential handling and least-privilege access.
• Experience troubleshooting telemetry and control-coverage gaps, working with MDR or SOC teams, and driving technical issues through resolution with vendors and internal owners.
• Clear documentation and communication skills, including the ability to explain operational tradeoffs, influence independent teams, and transfer knowledge to other engineers.

Nice To Haves

• Experience with enterprise EDR/XDR, MDR, SOAR, or secure-access platforms.
• Experience with shared-services or multi-tenant environments.
• Experience with cloud-hosted automation, infrastructure as code, or detection validation.
• Relevant certifications or experience with equivalent technologies.

Responsibilities

• Assess security platform configurations, integration health, and recurring manual work.
• Prioritize an engineering roadmap with the Director of Cybersecurity based on risk, operational effort, and business impact.
• Design, build, and maintain SOAR workflows for investigation, enrichment, containment, and remediation using native platform capabilities and custom code where appropriate.
• Engineer integrations across endpoint, email, secure-access, identity, logging, and ticketing platforms using APIs, webhooks, and supported connectors.
• Own security platform configuration standards and integration reliability.
• Detect telemetry gaps, unhealthy agents, expired credentials, and failed jobs; automate recovery or route actionable exceptions to the responsible team.
• Build and validate automated containment and remediation workflows, defining action scope, exclusions, approval thresholds, and recovery procedures with service owners.
• Build production automation with least-privilege service access, secure secrets handling, input validation, retries, duplicate-event handling, audit logs, and failure alerts.
• Test changes and stage deployments before broad rollout.
• Validate MDR telemetry coverage, response permissions, and escalation paths; work with the provider to resolve gaps and verify contracted response actions in each supported environment.
• Exercise detection-to-response workflows through controlled testing, validate containment outcomes, and turn incident lessons and recurring failures into engineering improvements.
• Create reusable configurations, integration patterns, and acceptance checks for operating-company onboarding.
• Maintain separation of credentials, data, and response scope across tenants and operating companies.
• Partner with IAM, cloud, and AI security engineers on cross-platform workflows while those engineers retain ownership of their domain controls.
• Coordinate endpoint and network changes with the responsible IT teams.
• Document runbooks and support procedures, mentor engineers, and train operational backups.
• Track automation success, failure rates, response times, coverage, and manual effort reduced.

Benefits

• 401(k) plan with an employer match
• Health, dental, vision, and life insurance
• Paid Time Off (PTO)
• 11 firm holidays
• Hybrid office/work-from-home arrangement
• Annual year-end bonus eligibility
• Collegial, entrepreneurial work environment committed to personal and professional growth

What This Job Offers

• Job Type: Full-time
• Career Level: Senior