Note: The job is a remote job and is open to candidates in USA. Blackbaud is a purpose-driven technology company focused on social impact and responsible AI. The Principal Security Engineer, Orchestration and Automation, will build security automation, orchestration, and AI-driven detection and response capabilities, including SOAR workflows, SIEM integrations, detection logic, and Python-based tooling.
Responsibilities
- Design, build, and maintain orchestration workflows and SOAR playbooks that automate triage, enrichment, containment, and response actions across the security tool stack
- Apply AI/ML and LLM-assisted techniques (e.g., automated alert summarization, natural-language investigation assistance, anomaly scoring) to reduce analyst workload and speed decision-making
- Develop and maintain Python-based integrations and APIs connecting the SIEM, SOAR, EDR, ticketing, threat intel, and cloud platforms into unified automated workflows
- Design, build, and tune SIEM correlation rules, alerts, and detection use cases mapped to MITRE ATT&CK, with an eye toward which detections can be paired with automated response
- Own core SIEM administration tasks needed to support automation and detection: data source onboarding, index/data model health, log ingestion monitoring, and configuration management
- Build and maintain custom field extractions, parsers, and content packs to ensure new data sources are automation- and detection-ready
- Continuously tune detections and automation logic to improve signal-to-noise ratio, reduce false positives, and reduce mean-time-to-respond (MTTR)
- Create dashboards and reporting that measure automation coverage, orchestration reliability, AI-assisted triage accuracy, and detection effectiveness
- Apply CI/CD and infrastructure-as-code practices to manage detection content, playbooks, and integrations as versioned, testable code
- Evaluate and pilot new automation, orchestration, and AI tooling to expand the detection and response automation footprint
Skills
- 5+ years building automation, orchestration, or SOAR playbooks in a cyber security or SOC environment
- 3+ years of SIEM engineering or administration experience - data onboarding, correlation rule development, platform configuration
- Strong Python (or comparable scripting) skills; experience building APIs/integrations across security and IT tooling
- Hands-on experience with AI/ML or LLM-based tooling applied to security use cases - triage, summarization, enrichment, and/or anomaly detection
- Working knowledge of MITRE ATT&CK and experience mapping detections/automation to adversary tactics and techniques
- Experience with a SOAR or security orchestration platform (e.g., NG-SIEM Fusion, Splunk SOAR, Palo Alto XSOAR, Tines, or similar)
- Cloud security experience (AWS, Azure, or GCP), including automation for ingesting and processing security data from cloud sources
- Experience with CI/CD, infrastructure-as-code, and version-controlling detection/automation content
- Familiarity with containerized and serverless environments and their automation/logging considerations
- Experience building such capability strongly preferred
- SIEM, SOAR, or security automation platform certification preferred
- Regulatory compliance experience a plus
Benefits
- Medical, dental, and vision insurance
- Remote-flexible workforce
- Wellness Programs
- 401(k) program with employer match
- Flexible paid time off
- Generous Parental Leave
- Donations for Doers
- Pet insurance, legal and identity protection
- Tuition reimbursement program
Company Overview
Company H1B Sponsorship