Security Operations Automation Engineer (Google SecOps / XSIAM)

About the role

IBM Consulting is hiring a Technical or Security Consultant specializing in Intelligence & Operations. The consultant helps clients understand and address security issues, exposures and vulnerabilities, articulating effective security strategies and mitigation measures. The role centres on Google SecOps (formerly Chronicle Security) and/or Palo Alto XSIAM platforms.

Key responsibilities

• Operate and administer Google SecOps and/or Palo Alto XSIAM platforms.
• Design, configure and maintain automation workflows, including playbooks, actions, automations and rules.
• Develop and maintain custom automation actions using Python.
• Integrate security tools and data sources using REST APIs.
• Analyze indicators of compromise (IOCs), investigate alerts and support security incident investigations.
• Collaborate with SOC and engineering teams to improve detection, response and automation maturity across the SecOps ecosystem.

Required profile

• Hands-on experience operating Google SecOps (Chronicle) and/or Palo Alto XSIAM.
• Solid understanding of security automation concepts (playbooks, rules, workflows).
• Experience developing custom integrations or automations using Python.
• Practical knowledge of REST API integrations between security platforms.
• Strong understanding of SIEM, XDR/EDR and how security controls operate in a SecOps ecosystem.
• Experience with alert analysis, IOC handling and incident investigation.
• 2+ years of experience in similar SecOps, SOC Engineering or Security Automation roles.
• Intermediate English level (technical communication).

Required skills

• Google SecOps (Chronicle) and/or Palo Alto XSIAM
• Python
• REST API integration
• Preferred: traditional SOAR platforms such as IBM SOAR, Splunk SOAR, Cortex XSOAR
• Preferred: Bash, PowerShell or CI/CD tools
• Preferred: MITRE ATT&CK and NIST frameworks, security use case design, Google Cloud Security or Palo Alto Networks certifications