Design, Deploy, configure, and operationalize Palo Alto Cortex Security Orchestration, Automation, and Response (XSOAR) , implementing automation playbooks, integrations, and incident workflows to support the Security Operations Centre (SOC).

Key Responsibilities

- Design XSOAR architecture and deployment model (multi-tenant, scalable)
- Deploy and configure Cortex XSOAR platform components
- Playbook isolation
- Role-Based Access Control (RBAC) model
- Define high availability (HA), disaster recovery (DR), and backup strategies
- Implement incident ingestion from SIEM into XSOAR
- Build and maintain automation playbooks :
- Phishing response
- ETC
- Configure and maintain integrations with:
- Elastic SIEM
- Endpoint Detection and Response (EDR) tools
- Firewalls and network tools
- Identity and Access Management (IAM) systems
- Ticketing platforms (ServiceNow, Jira, BMC Remedy)
- Implement Role-Based Access Control (RBAC) and tenant separation
- Configure incident types, fields, layouts, and workflows (SecIM)
- Perform testing and validation of playbooks and integrations
- Troubleshoot:
- API connectivity issues
- Support platform monitoring, upgrades, and maintenance
- Assist with automation scripting (Python, APIs)




- Support deployment automation and configuration management
- Work closely with Architects and SOC teams to refine workflows

Required Skills

- Strong experience with Palo Alto Cortex XSOAR architecture
- Hands-on experience with Palo Alto Cortex XSOAR
- Experience building automation playbooks and integrations
- Solid knowledge of application programming interfaces (APIs)
- Scripting experience ( Python preferred )
- Understanding of incident response workflows
- Experience with Linux systems and troubleshooting

Ideal Candidate Experience

- 3–7+ years in Security Operations, Incident Response, or Security Engineering
- 2–4+ years hands-on experience with Cortex XSOAR
- Experience implementing playbooks and automation in production SOC environments
- Experience integrating SIEM, EDR, identity, and ticketing tools
- Familiarity with:
- Continuous Integration and Continuous Deployment (CI/CD) pipelines
- Infrastructure as Code (IaC) (nice to have)
- Experience in large-scale or enterprise environments
- Exposure to regulated environments (government, telecom, finance) is a plus

Clearance Requirement

- Active Government of Canada Secret Clearance is mandatory

📌 XSOAR Engineer (Implementation & Deployment) (Mississauga)
🏢 Bell Cyber
📍 Mississauga