Vind vacatures die bij jouw situatie passen.

- Build and refine SOAR playbooks, automations, integrations, dashboards, and orchestration logic.
- Communicate and demonstrate new or updated workflows to operational teams.
- Ensure automation content is production‑ready with clear, maintainable documentation.
- Continuously monitor and optimize workflows to improve reliability, efficiency, and stability.
- Maintain and update SOAR workflows, integrations, content packs, and vendor modules.
- Promote content across environments using Git‑based version control and peer reviews.

- Strong Python skills for automation and integrations.
- Experience with REST APIs (OAuth2, API keys), JSON, and common web service standards.
- Hands‑on experience with automation testing: functional, scenario‑based, regression, and integration.
- Experience managing SOAR content across multi‑stage environments (dev → integration → prod).
- Knowledge of secure development practices, logging/auditing safeguards, and safe API handling.
- Understanding of IR workflows (triage, investigation, containment). SOC/IR experience is a plus.
- Solid understanding of SIEM, EDR, logging pipelines, network/security fundamentals.
- 3+ years in SOAR engineering, security automation, SOC engineering, or IR‑related roles.
- Hands‑on experience with Palo Alto Cortex XSOAR (Demisto).

- Clear and confident communicator with both technical and non‑technical audiences.
- Analytical, structured, and methodical problem‑solver.
- Collaborative, open‑minded, autonomous, and reliable.
- Fast learner with strong attention to detail and disciplined documentation habits.
- Comfortable in fast‑changing environments and able to manage multiple priorities.

#LI-YK1

- Modular, reusable SOAR components (sub‑playbooks, automation templates).
- CI/CD experience for validation and promotion of SOAR content.
- Experience maintaining XSOAR content packs or marketplace integrations.
- Additional scripting (JavaScript, PowerShell).
- Integrating SIEM and email ingestion sources (Splunk ES, MS Graph Mail API).
- Integration of external platforms (EDR, Azure, ServiceNow).
- Familiarity with event‑driven workflows (webhooks, async APIs, message triggers).