Design, develop, and maintain Python-based SOC automation workflows for alert triage, investigation, enrichment, incident handling, and response. Build reliable Temporal.io workflows and integrations with Microsoft Sentinel, Defender, REST APIs, databases, and threat intelligence systems. Develop KQL queries, translate SOC requirements into technical solutions, and improve automation scalability, observability, reliability, and analyst efficiency while collaborating with Cyber Defenders and cross-functional engineering teams.
As a leading provider of AI-powered extended managed detection and response (MXDR) services, Ontinue is on a mission to be the most trusted, 24/7, always-on security partner that empowers customers to embrace the future by using AI to operate more strategically, at scale, and with less risk. We believe that the combination of AI and human expertise is essential for delivering effective managed security that is tailored to a customer’s unique environment, operational constraints, and risks.
Continuous protection. AI-powered Nonstop SecOps. That’s Ontinue.
Role Overview
As a SOC Automation Engineer, you will help transform how our Cyber Defenders investigate and respond to security incidents.
Working at the intersection of cybersecurity, software engineering and automation, you will design, develop and maintain Python-based solutions that reduce manual effort, improve investigation quality and enable our global, 24/7 Security Operations Centre to operate effectively at scale.
Key Responsibilities
- Design, develop and maintain Python-based automation workflows supporting security investigation, alert triage, enrichment, incident handling and response
- Translate operational requirements and SOC analyst pain points into clearly defined, scalable automation use cases
- Develop complex workflows using Temporal.io, following engineering best practices for reliability, scalability, maintainability and observability
- Build integrations with security products, REST APIs, databases and other internal and external systems.
- Create automation capabilities across alert triage, threat intelligence, investigation, enrichment and incident response
- Work with Microsoft Security technologies, including Microsoft Sentinel, Microsoft Defender and Defender XDR, along with their associated telemetry and APIs
- Develop and optimise Kusto Query Language, or KQL, queries for investigation, enrichment, detection and automation use cases
- Design robust business logic capable of handling complex investigation scenarios and operational edge cases.
- Partner closely with Cyber Defenders to validate requirements and ensure automation delivers meaningful operational value
- Contribute throughout requirements analysis, technical design, implementation, testing and continuous improvement
- Monitor and improve automation performance, reliability, coverage and its impact on analyst workload.
- Help shape the evolution of Ontinue’s SOC automation architecture and engineering standards
What Success Looks Like
- Identify high-value automation opportunities arising from genuine SOC operational challenges.
- Translate cybersecurity requirements into clear, actionable technical designs
- Deliver reliable automation quickly and iteratively, improving solutions through feedback from SOC users
- Build workflows that are scalable, resilient, maintainable and observable
- Understand the security context behind each automation use case rather than simply implementing technical requirements to increase automation coverage, improve investigation quality and measurably reduce manual analyst workload.
- Collaborate effectively across SOC, Engineering, Product, AI and Platform teams
Required Experience & Skills
- At least three years of professional experience in software engineering, cybersecurity, security operations or automation engineering
- Hands-on software development experience, including coding, API integrations, data processing, error handling and asynchronous programming
- A solid understanding of SOC operations, including alert triage, incident investigation, enrichment, threat intelligence and response
- Experience with the Microsoft Security ecosystem, preferably including Microsoft Sentinel and Microsoft Defender
- Strong KQL skills and the ability to develop queries supporting security investigations and automation
- Experience with Git and modern software development practices, including testing, debugging, code reviews and CI/CD
- An understanding of distributed systems, asynchronous processing, workflow orchestration and scalable automation architectures
Preferred
- Experience developing automation for Microsoft Sentinel, Microsoft Defender for Endpoint, Defender XDR or associated Microsoft Security products
- Experience developing production automation workflows, ideally using Temporal.io or a comparable workflow orchestration frameworks
- Experience integrating REST APIs and working with authentication, JSON, webhooks and external services and cybersecurity APIs or threat intelligence platforms
- Knowledge of common attack techniques and frameworks, including MITRE ATT&CK
Next Steps
If you have the skills and experience required and feel that Ontinue is a place you can belong, we would love to get to know you better! Please drop an application to this role and our talent acquisition manager will be in touch to discuss further.
Learn more: www.ontinue.com
Similar Jobs
Big Data • Information Technology • Software • Analytics • Energy
Administers and analyzes sales compensation programs, including commission payout processing, data auditing, dispute resolution, plan modeling, reporting, and dashboard maintenance. Partners with sales, finance, and HR teams to ensure accurate payouts, compliance, documentation, and process improvements. Requires strong Excel modeling skills, CRM and incentive compensation platform experience, analytical ability, communication skills, and independent judgment.
Top Skills:
CaptivateiqExcelPerformioSalesforceVaricentXactly
Fintech • Information Technology • Insurance • Financial Services • Big Data Analytics
Leads enterprise data and analytics strategy, architecture, modernization, and delivery across cloud and on-premises environments. Oversees data platforms, engineering, integration, governance, quality, lineage, security, and compliance. Partners with executives to define roadmaps and investments, manages cross-functional teams and vendors, enables AI/ML capabilities, and mentors data professionals while driving scalable, trusted data solutions and measurable business outcomes.
Top Skills:
AgileSparkAzure Data PlatformCloud ComputingData GovernanceData LakesData LineageData WarehousingDatabricksMaster Data ManagementMetadata ManagementAzurePythonSQL
Cloud • Computer Vision • Information Technology • Sales • Security • Cybersecurity
Drive revenue growth in the corporate segment by managing full-cycle enterprise sales, developing strategic account plans, building C-level relationships, partnering with channel teams, forecasting pipeline, and advising customers on cybersecurity solutions. The role requires consistent quota achievement, complex multi-product software sales experience, strong presentation skills, technical aptitude, and effective use of sales and AI technologies.
Top Skills:
AICybersecurity SoftwareLinkedin Sales NavigatorSaaSSalesforceZoominfo
What you need to know about the Los Angeles Tech Scene
Los Angeles is a global leader in entertainment, so it’s no surprise that many of the biggest players in streaming, digital media and game development call the city home. But the city boasts plenty of non-entertainment innovation as well, with tech companies spanning verticals like AI, fintech, e-commerce and biotech. With major universities like Caltech, UCLA, USC and the nearby UC Irvine, the city has a steady supply of top-flight tech and engineering talent — not counting the graduates flocking to Los Angeles from across the world to enjoy its beaches, culture and year-round temperate climate.
Key Facts About Los Angeles Tech
- Number of Tech Workers: 375,800; 5.5% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Snap, Netflix, SpaceX, Disney, Google
- Key Industries: Artificial intelligence, adtech, media, software, game development
- Funding Landscape: $11.6 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Strong Ventures, Fifth Wall, Upfront Ventures, Mucker Capital, Kittyhawk Ventures
- Research Centers and Universities: California Institute of Technology, UCLA, University of Southern California, UC Irvine, Pepperdine, California Institute for Immunology and Immunotherapy, Center for Quantum Science and Engineering
