Senior Swimlane Automation Engineer/Architect

About Role

Key Responsibilities:

• Architect, design, and implement end-to-end Swimlane playbooks covering the full automation lifecycle — from requirements gathering through deployment and post-deployment tuning.
• Lead the development of automation workflows for threat detection, incident response, alert triage, and case management use cases.
• Integrate Swimlane with SIEM platforms (e.g., Splunk, Microsoft Sentinel, IBM QRadar, SecOps or similar) and other security tooling to enable seamless data flow and orchestration.
• Write, review, and maintain Python-based scripts, custom actions, and Turbine components to extend platform capabilities and support complex automation logic.
• Define and enforce coding standards, design patterns, and best practices for Swimlane development across the team.
• Conduct thorough testing, debugging, and performance optimization of playbooks and integrations in development, staging, and production environments.
• Produce and maintain comprehensive technical documentation including architecture diagrams, runbooks, and operational guides.
• Provide technical mentorship and guidance to junior automation engineers and SOC personnel.
• Partner with stakeholders to identify automation opportunities, assess feasibility, and prioritize the automation roadmap.
• Stay current with emerging SOAR capabilities, threat trends, and industry best practices to continuously improve the automation program.

Required Qualifications:

• Hands-on expertise with Swimlane, including full-lifecycle playbook development and platform administration.
• Proficiency with Python for scripting, custom action development, and API integrations.
• Demonstrated experience with Swimlane Turbine, including building and deploying Turbine components and understanding its execution model.
• Practical experience integrating with at least one major SIEM platform (Splunk, Microsoft Sentinel, IBM QRadar, SecOps, or equivalent).
• Strong understanding of REST APIs and experience developing integrations with third-party security and IT tools.
• Solid grasp of incident response processes, SOC workflows, and common security use cases (phishing, malware, identity threats, etc.).
• Excellent analytical, problem-solving, and communication skills, with the ability to translate technical concepts for non-technical stakeholders.

Diversity & Inclusion Mission Statement