Design, Deploy, configure, and operationalize

Palo Alto Cortex Security Orchestration, Automation, and Response (XSOAR) , implementing automation playbooks, integrations, and incident workflows to support the Security Operations Centre (SOC).

Key Responsibilities

Design

XSOAR architecture and deployment model

(multi-tenant, scalable)

Deploy and configure

Cortex XSOAR platform components

Playbook isolation

Role-Based Access Control (RBAC) model

Define high availability (HA), disaster recovery (DR), and backup strategies

Implement

incident ingestion from SIEM

into XSOAR

Build and maintain

automation playbooks :

Phishing response

ETC

Configure and maintain integrations with:

Elastic SIEM

Endpoint Detection and Response (EDR) tools

Firewalls and network tools

Identity and Access Management (IAM) systems

Ticketing platforms (ServiceNow, Jira, BMC Remedy)

Implement

Role-Based Access Control (RBAC)

and tenant separation

Configure

incident types, fields, layouts, and workflows (SecIM)

Perform

testing and validation of playbooks and integrations

Troubleshoot:

API connectivity issues

Support

platform monitoring, upgrades, and maintenance

Assist with

automation scripting

(Python, APIs)

Support





deployment automation and configuration management

Work closely with Architects and SOC teams to refine workflows

Required Skills

Strong experience with

Palo Alto Cortex XSOAR

architecture

Hands-on experience with

Palo Alto Cortex XSOAR

Experience building

automation playbooks and integrations

Solid knowledge of

application programming interfaces (APIs)

Scripting experience ( Python preferred )

Understanding of

incident response workflows

Experience with

Linux systems and troubleshooting

Ideal Candidate Experience

3–7+ years in

Security Operations, Incident Response, or Security Engineering

2–4+ years hands-on experience with

Cortex XSOAR

Experience implementing

playbooks and automation in production SOC environments

Experience integrating SIEM, EDR, identity, and ticketing tools

Familiarity with:

Continuous Integration and Continuous Deployment (CI/CD) pipelines

Infrastructure as Code (IaC) (nice to have)

Experience in

large-scale or enterprise environments

Exposure to

regulated environments (government, telecom, finance) is a plus

Clearance Requirement

Active Government of Canada Secret Clearance is mandatory

#J-18808-Ljbffr

📌 XSOAR Engineer (Implementation & Deployment) (Winnipeg)
🏢 Bell Cyber
📍 Winnipeg