Security Consultant - Cortex XSOAR

Introduction

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You'll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you'll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You'll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences.

Your role and responsibilities

Key Responsibilities

• Playbook Development: Design, code, test, and debug complex incident response playbooks in Cortex XSOAR using Python and the platform's visual playbook editor.
• Integration Management: Develop and maintain custom integrations with third-party security tools (EDR, SIEM, Firewalls, Ticketing Systems, Threat Intel Platforms) using the Cortex XSOAR API and Python.
• Content Management: Manage the full lifecycle of XSOAR content (Playbooks, Integrations, Scripts, Classifiers, Mappers, Dashboards) using version control systems like Git.
• Incident Response Enhancement: Collaborate with SOC analysts to understand pain points in current IR processes and translate requirements into automated solutions to reduce manual intervention.
• Maintenance & Troubleshooting: Monitor the health of the XSOAR environment, troubleshoot failed automations, and optimize performance and API usage.
• Documentation: Maintain thorough documentation of playbooks, integrations, and standard operating procedures (SOPs).

Required education
Bachelor's Degree

Preferred education
Master's Degree

Required technical and professional expertise

Required Skills & Qualifications

• Experience: [3-5+] years of experience in Security Engineering, DevOps, or Software Engineering, with at least [2+] years specifically working withPalo Alto Networks Cortex XSOAR.
• Programming: Strong proficiency inPython (essential for custom scripts and integrations). Experience with JavaScript or PowerShell is a plus.
• XSOAR Proficiency: Deep understanding of Cortex XSOAR architecture, including Incident Types, Layouts, Fields, Classifiers, Mappers, and the core automation engine.
• APIs & Integrations: Proven experience consuming RESTful APIs to connect disparate security tools. Ability to troubleshoot API authentication and data parsing issues.
• Security Domain Knowledge: Solid understanding of the Incident Response lifecycle, common attack vectors (MITRE ATT&CK), and security technologies (SIEM, EDR, SOAR, TIP).

Preferred technical and professional experience

• Cortex XSOAR Certification: Palo Alto Networks Certified Automation Engineer (PACE) orXSOAR Certification
• SIEM Experience: Familiarity with SIEM platforms such as XSIAM, Splunk, QRadar, or Microsoft Sentinel.
• Containers: Understanding of Docker, as XSOAR integrations run in containerized environments.

Years of Experience:
3-5