Security Architect

Security Automation Architect

12 month contract. Possibility of extension

W2 with comprehensive health benefits, paid holidays, and sick time accural

Pay: $90/hr

Fully remote

applications will be accpeted through September 23, 2026

Overview

Our clients AI Security team is standing up the automation layer on top of Palo Alto's Cortex XSIAM, their security operations platform. XSIAM ingests log and telemetry data from across the environment — network, Wiz, WAF, SSO, and other sources — and correlates it into alerts. The value is in what happens next: automated response.

For example, when a user account strings together a series of suspicious actions in a short window, the platform can determine with high confidence the account is compromised and automatically call out to another system to suspend it — no analyst in the loop.

This role owns the design of that automation program. You'll define how automation gets built: what the reusable patterns look like, where the integration boundaries sit, what gets fully automated versus what stays human-in-the-loop, and how it all gets tested before it touches production. You'll be paired with a Security Automation Engineer who builds against your designs.

What you'll do

• Own the architecture and technical direction for security automation across the XSIAM platform
• Define reusable playbook patterns, shared components, and a consistent integration framework so automation scales past one-off scripts
• Make the judgment calls on automation scope — which responses are safe to fully automate, which need an analyst gate, and what the blast radius is when an automation misfires
• Run requirements and roadmap conversations with Incident Response and other security stakeholders, then translate those into a prioritized build plan
• Establish engineering standards: code review, testing approach, error handling, rollback, documentation
• Guide and review the work of the automation engineer building against your designs
• Evaluate Palo Alto's out-of-the-box content and determine what to adopt, what to customize, and what to build from scratch

Required

• Senior-level engineering background with deep, current Python
• Prior ownership of a SOAR or security automation platform — XSIAM, XSOAR, Splunk SOAR, Tines, Swimlane, or equivalent
• Strong systems integration architecture: REST APIs, auth patterns, data normalization across heterogeneous sources, failure handling at scale
• Working knowledge of security operations — incident response workflow, alert triage, the practical cost of false positives when automation takes destructive action
• Proven ability to run technical requirements sessions with stakeholders and drive to decisions
• Experience setting standards for and reviewing other engineers' work

Nice to have

• Direct Cortex XSIAM experience, or XSOAR at depth
• Familiarity with the surrounding stack: Wiz, WAF platforms, Okta/Entra ID
• MITRE ATT&CK fluency
• Cloud security architecture (AWS, Azure, GCP)
• Healthcare or other regulated-industry security experience

What makes someone successful here

This is a design-and-decide role, not a heads-down build role. The hardest part isn't writing the automation — it's knowing which automations are worth building, which ones are too risky to run unattended, and how to get security teams to tell you what actually slows them down. Someone who can sit with an IR analyst, watch how they work, and come back with the right three things to automate will do well.

About Us:

At Brooksource, relationships are the foundation of everything we do. Since 2000, we’ve built lasting partnerships with clients, consultants, and internal teams to deliver an exceptional experience across every engagement. As a trusted IT and Engineering services provider, Brooksource supports Fortune 500 organizations through Experience-Driven Staffing, Professional Services, and Elevate, our proprietary Workforce Transformation program. Whether you're hiring for software development, cloud computing, cybersecurity, data analytics, or enterprise IT, our customized staffing solutions are designed to align with your company’s unique goals, culture, and technology stack. We offer flexible hiring models, including contract, contract-to-hire, and direct placement to meet your evolving business needs.

We are a certified partner of leading platforms, including Salesforce, AWS, Microsoft, and Google Cloud, enabling us to deliver scalable, end-to-end technology solutions. With a growing national footprint, Brooksource is redefining expectations in IT consulting, engineering services, and technology workforce solutions.

EEO Statement:

Brooksource is an equal opportunity employer that does not discriminate on the basis of actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex or gender (including pregnancy, childbirth, lactation and related medical conditions), gender identity or gender expression, sexual orientation, marital status, military service and veteran status, physical or mental disability, protected medical condition as defined by applicable state or local law, genetic information, or any other characteristic protected by applicable federal, state, or local laws and ordinances.

Benefits & Perks

Benefits & Perks: Brooksource offers competitive medical, dental, vision, Health Savings Account, Dependent Care FSA, and supplemental coverage with plans that can fit each employee’s needs. We offer a 401k plan that includes a company match and is fully vested after you become eligible, paid time off, sick time, and paid company holidays. We also offer an Employee Assistance Program (EAP) that provides services like virtual counseling, financial services, legal services, life coaching, etc.

Pay Disclaimer:

The pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.