Security Automation Engineering Lead

Why we're hiring:

The Automation Lead is responsible for leading the engineering, delivery, and continual enhancement of security automation capabilities across Operational Security. This role oversees Security Automation Engineers and owns the end-to-end automation lifecycle including SOAR playbooks, integrations, AI-driven orchestration, workflow automation, and tooling optimisation. The Automation Lead ensures automation solutions are scalable, robust, and aligned to the Autonomic Security Operations (ASO) model and GCAT SOC10x principles.

What you'll be doing:

Automation Engineering Leadership

• Lead a team of Security Automation Engineers in developing high-quality automation solutions.
• · Own the delivery of SOAR playbooks, integrations, scripts, and automated workflows.
• · Set automation engineering standards for code quality, testing, version control, and documentation.
• · Provide technical leadership across scripting (Python, PowerShell), APIs, and data pipelines.
• · Ensure automation aligns with the strategy set by the Head of Automation & Process Engineering.

Automation Delivery & Technical Ownership

• Design and deliver automation for alert triage, enrichment, containment, remediation, and investigations.
• · Develop scalable SOAR playbooks and reusable automation modules.
• · Integrate SOAR with SIEM, EDR, TIP, cloud-native tools, and case management systems.
• · Monitor automation performance and drive enhancements based on operational metrics.
• · Ensure interoperability across Microsoft and Google security ecosystems.

AI & Machine Learning–Enhanced Automation

• Integrate AI models into automation workflows for enrichment, correlation, and decision support.
• · Collaborate with Data Science and Detection Engineering teams to embed ML insights.
• · Operationalise AI-driven automation to reduce manual workloads and improve detection fidelity.

Process Excellence & Workflow Optimisation

• · Translate security workflows into automated processes ensuring accuracy and consistency.
• · Identify inefficiencies across SOC, IR, Threat Hunting, and Engineering workflows.
• · Maintain standardised automation patterns and process models.
• · Support integration of automation into Operational Security SOPs and response playbook

Stakeholder Collaboration

• · Work with Detection Engineering, IR, Threat Hunting, and Threat Intelligence teams to prioritise automation needs.
• · Collaborate with Ops Assurance, Legal, Privacy, and vendors for solution alignment.
• · Act as the automation subject matter expert during major incidents and post-incident reviews.

Continuous Improvement & Innovation

• · Maintain and refine the automation backlog for enhancements and new opportunities.
• · Evaluate emerging technologies, APIs, and tooling to advance automation capabilities.
• · Embed GCAT SOC10x principles across automation solutions (10X People, Process, Tech, Speed).

What you'll need:

Technical Expertise

• · Strong hands-on experience with SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Chronicle SOAR).
• · Proficiency in Python, PowerShell, REST APIs, JSON, and automation engineering.
• · Experience integrating SIEM, EDR, TIP, cloud security tools, and case management systems.
• · Understanding of AI/ML concepts and how to embed models into automated workflows.

Process & Operational Knowledge

• · Strong understanding of SecOps workflows across SOC, IR, Threat Hunting, and Detection Engineering.
• · Experience translating complex workflows into scalable automated processes.
• · Knowledge of SOP development, workflow governance, and continuous improvement frameworks.

Leadership & Collaboration

• · Experience mentoring engineers and leading technical delivery teams.
• · Strong stakeholder engagement and communication skills.
• · Ability to influence technical decisions across cross-functional teams.

Certifications (Preferred)

• · GIAC (GMON, GCIH, GCTI, GCDA)
• · SOAR or automation engineering certifications
• · Cloud certifications (Azure / GCP)
• · Python or scripting certifications

Key Attributes

• · Engineering-first mindset with strong problem-solving skills.
• · Able to simplify complex workflows into engineered automation.
• · Detail-oriented with strong organisational and documentation habits.
• · Committed to operational excellence and continuous improvement

Who you are:

You're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.

You're optimistic: We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.

You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.

What we'll give you:

Passionate, inspired people – We aim to create a culture in which people can do extraordinary work.

Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.

Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?

#LI-Hybrid