Security Consultant - XSOAR L2

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You’ll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you’ll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You’ll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences.

We are seeking a skilled engineer to design, develop, and maintain playbooks and integrations within Cortex XSOAR. You will bridge the gap between security operations and software development, translating incident response workflows into efficient, automated code. You will work closely with threat hunters, SOC analysts, and IT teams to identify repetitive tasks and build resilient automations.

Key Responsibilities

• Playbook Development: Design, code, test, and debug complex incident response playbooks in Cortex XSOAR using Python and the platform’s visual playbook editor.
• Integration Management: Develop and maintain custom integrations with third-party security tools (EDR, SIEM, Firewalls, Ticketing Systems, Threat Intel Platforms) using the Cortex XSOAR API and Python.
• Content Management: Manage the full lifecycle of XSOAR content (Playbooks, Integrations, Scripts, Classifiers, Mappers, Dashboards) using version control systems like Git.
• Incident Response Enhancement: Collaborate with SOC analysts to understand pain points in current IR processes and translate requirements into automated solutions to reduce manual intervention.
• Maintenance & Troubleshooting: Monitor the health of the XSOAR environment, troubleshoot failed automations, and optimize performance and API usage.
• Documentation: Maintain thorough documentation of playbooks, integrations, and standard operating procedures (SOPs).

• Experience: [4+] years of experience in Security Engineering, DevOps, or Software Engineering, with at least [3+] years specifically working with Palo Alto Networks Cortex XSOAR.
• Programming: Strong proficiency in Python (essential for custom scripts and integrations). Experience with JavaScript or PowerShell is a plus.
• XSOAR Proficiency: Deep understanding of Cortex XSOAR architecture, including Incident Types, Layouts, Fields, Classifiers, Mappers, and the core automation engine.
• APIs & Integrations: Proven experience consuming RESTful APIs to connect disparate security tools. Ability to troubleshoot API authentication and data parsing issues.
• Security Domain Knowledge: Solid understanding of the Incident Response lifecycle, common attack vectors (MITRE ATT&CK), and security technologies (SIEM, EDR, SOAR, TIP).
• Problem Solving: Excellent analytical skills with the ability to debug complex, distributed system issues.

• Cortex XSOAR Certification
• SIEM Experience: Familiarity with SIEM platforms such as XSIAM, Splunk, QRadar, or Microsoft Sentinel.

In a world where technology never stands still, we understand that, dedication to our clients success, innovation that matters, and trust and personal responsibility in all our relationships, lives in what we do as IBMers as we strive to be the catalyst that makes the world work better.

Being an IBMer means you’ll be able to learn and develop yourself and your career, you’ll be encouraged to be courageous and experiment everyday, all whilst having continuous trust and support in an environment where everyone can thrive whatever their personal or professional background.

Our IBMers are growth minded, always staying curious, open to feedback and learning new information and skills to constantly transform themselves and our company. They are trusted to provide on-going feedback to help other IBMers grow, as well as collaborate with colleagues keeping in mind a team focused approach to include different perspectives to drive exceptional outcomes for our customers. The courage our IBMers have to make critical decisions everyday is essential to IBM becoming the catalyst for progress, always embracing challenges with resources they have to hand, a can-do attitude and always striving for an outcome focused approach within everything that they do.

Are you ready to be an IBMer?

IBM’s greatest invention is the IBMer. We believe that through the application of intelligence, reason and science, we can improve business, society and the human condition, bringing the power of an open hybrid cloud and AI strategy to life for our clients and partners around the world.

Restlessly reinventing since 1911, we are not only one of the largest corporate organizations in the world, we’re also one of the biggest technology and consulting employers, with many of the Fortune 500 companies relying on the IBM Cloud to run their business. 

At IBM, we pride ourselves on being an early adopter of artificial intelligence, quantum computing and blockchain. Now it’s time for you to join us on our journey to being a responsible technology innovator and a force for good in the world.

IBM is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, genetics, pregnancy, disability, neurodivergence, age, or other characteristics protected by the applicable law. IBM is also committed to compliance with all fair employment practices regarding citizenship and immigration status.

When applying to jobs of your interest, we recommend that you do so for those that match your experience and expertise. Our recruiters advise that you apply to not more than 3 roles in a year for the best candidate experience. For additional information about location requirements, please discuss with the recruiter following submission of your application.