Design, Deploy, configure, and operationalize Palo Alto Cortex Security Orchestration, Automation, and Response (XSOAR) , implementing automation playbooks, integrations, and incident workflows to support the Security Operations Centre (SOC).

Key Responsibilities

Design XSOAR architecture and deployment model (multi-tenant, scalable)

Deploy and configure Cortex XSOAR platform components

Playbook isolation

Role-Based Access Control (RBAC) model

Define high availability (HA), disaster recovery (DR), and backup strategies

Implement incident ingestion from SIEM into XSOAR

Build and maintain automation playbooks :

Phishing response

ETC

Configure and maintain integrations with:

Elastic SIEM

Endpoint Detection and Response (EDR) tools

Firewalls and network tools

Identity and Access Management (IAM) systems

Ticketing platforms (ServiceNow, Jira, BMC Remedy)

Implement Role-Based Access Control (RBAC) and tenant separation

Configure incident types, fields, layouts, and workflows (SecIM)

Perform testing and validation of playbooks and integrations

Troubleshoot:

API connectivity issues

Support platform monitoring, upgrades, and maintenance

Assist with automation scripting (Python, APIs)





Support deployment automation and configuration management

Work closely with Architects and SOC teams to refine workflows

Required Skills

Robust experience with Palo Alto Cortex XSOAR architecture

Hands-on experience with Palo Alto Cortex XSOAR

Experience building automation playbooks and integrations

Strong knowledge of application programming interfaces (APIs)

Scripting experience ( Python preferred )

Understanding of incident response workflows

Experience with Linux systems and troubleshooting

Ideal Candidate Experience

3–7+ years in Security Operations, Incident Response, or Security Engineering

2–4+ years hands-on experience with Cortex XSOAR

Experience implementing playbooks and automation in production SOC environments

Experience integrating SIEM, EDR, identity, and ticketing tools

Familiarity with:

Continuous Integration and Continuous Deployment (CI/CD) pipelines

Infrastructure as Code (IaC) (nice to have)

Experience in large-scale or enterprise environments

Exposure to regulated environments (government, telecom, finance) is a plus

Clearance Requirement

Active Government of Canada Secret Clearance is mandatory

#J-18808-Ljbffr

📌 XSOAR Engineer (Implementation & Deployment) (Ontario)
🏢 Bell Cyber
📍 Ontario