Software Engineer, SOC Automation

ATCO • Calgary, AB

2d

About The Position

The Software Engineer, SOC Automation plays a key role in advancing ATCO’s threat mitigation capabilities across enterprise IT, cloud, and operational technology environments. Reporting to the Manager, Cybersecurity Operations Center, this role focuses on designing, implementing, and continuously improving automated threat protection and response solutions that support a modern, high-performing Security Operations Center (SOC). As a subject matter expert in detection engineering and automation, you will connect threat intelligence to real-time operations by developing high-fidelity correlation rules, integrating AI/ML capabilities, and enabling faster, more consistent response through automation and orchestration. You will work across diverse technologies and platforms to embed security visibility into digital systems while maintaining alignment with regulatory frameworks and cybersecurity best practices.

Requirements

• University degree in Software Engineering or Computer Engineering
• 5+ years’ experience in cybersecurity operations, detection engineering, incident response, or security automation
• Strong proficiency in programming and scripting (e.g., Python) and security analytics query languages (e.g., KQL, SPL, Sigma, YARA)
• Experience working with SIEM, EDR, NDR, and SOAR platforms
• Knowledge of Threat Analytics Engineering principles, including Detection-as-Code methodologies
• Familiarity with AI/ML applications in cybersecurity and automation of SOC workflows
• Strong understanding of cybersecurity frameworks and standards such as NIST CSF, MITRE ATT&CK®, and NERC CIP
• Ability to analyze evolving threats across IT, OT, and cloud environments
• Experience developing automated workflows and orchestration strategies to improve response times
• Strong analytical, problem-solving, and communication skills
• Ability to work independently and collaborate across teams
• Available to respond to after-hours incidents

Nice To Haves

• CISM, CISSP and/or CRISC certifications are considered assets
• Experience working in complex environments such as utilities, energy, or critical infrastructure is an asset

Responsibilities

• Design, build, and optimize high-fidelity signatures across SIEM, EDR, NDR, and cloud platforms to improve threat visibility
• Align protection coverage to frameworks such as MITRE ATT&CK® and identify and prioritize visibility gaps
• Improve alert quality by reducing false positives and strengthening analytics logic to enable faster response
• Develop and implement automated SOAR playbooks and workflows to enhance response speed and consistency
• Build integrations and scripts to connect security tools and streamline SOC operations
• Contribute to AI/ML-driven capabilities to identify advanced threats and anomalies
• Leverage automation and LLM technologies to improve alert triage and response processes
• Conduct threat modeling and proactive threat hunting activities
• Translate threat intelligence and adversary techniques into actionable SOC workflow logic
• Support a Detection-as-Code approach using CI/CD and version control practices
• Participate in testing, validation, and continuous tuning of SOC use case content
• Maintain documentation for use case coverage, automation workflows, and integrations
• Collaborate with IT, OT, cloud, and application teams to embed threat protection capabilities into systems
• Communicate technical findings and recommendations to both technical and business stakeholders

Benefits

• A culture based on caring, integrity, agility, collaboration, and striving for excellence
• Competitive compensation
• Flex benefits
• Tuition assistance program
• Training and mentorship programs
• Charitable donation matching

What This Job Offers

• Job Type: Full-time
• Career Level: Senior