SOAR Automation Engineer

Who We Are

At Kyndryl, we run and reimagine the mission-critical technology systems that drive advantage for the world's leading businesses. We are at the heart of progress; with proven expertise and a continuous flow of AI-powered insight, enabling smarter decisions, faster innovation, and a lasting competitive edge. For our people-Kyndryls-that means doing purposeful work that powers human progress. Join us and experience a flexible, supportive environment where your well-being is prioritized and your potential can thrive.

The Role

Kyndryl's Security & Resiliency is one of our most critical practices, ensuring enterprises, regardless of their size and complexity, remain secure, available, reliable, and resilient. We take Cybersecurity seriously. We're not just invested; we're committed. We're not just protecting data; we're empowering. Kyndryl is committed to making the world safer, not only by investing in state-of-the-art services and technologies but also by empowering underserved communities with essential cyber skills.

• Design, build, and maintain automation playbooks in Azure Logic Apps for triage, enrichment, containment, and remediation workflows.
• Ireate manual and automated triggers for alerts and incidents originating from Microsoft Sentinel and related platforms.
• Manage and refine automation rules to orchestrate multi-step, conditional responses across correlated analytics rules.
• Develop custom connectors and APIs to extend automation capabilities across cloud and on-prem environments.
• Maintain source control, versioning, and documentation for all playbooks and automation artifacts.
• Collaborate with SOC Analysts, Detection Engineers, and Platform Owners to align automations with operational priorities and security SLAs.

• Participate in SOC transformation workshops to identify automation opportunities, process bottlenecks, and SLA improvements.
• Work with SOC leadership to define and refine KPIs related to Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), ticket volume reduction, and manual intervention rates.
• Contribute to continuous improvement cycles by analyzing automation performance, user adoption, and incident outcomes.
• Support audit and governance reviews by maintaining compliance-ready automation documentation.

• Design and embed GenAI-powered workflows into SOC processes for incident summarization, automated RCA generation, and contextual threat response.
• Co-develop AI-driven playbooks and prompt templates that continuously learn and adapt based on incident data.Use Microsoft Copilot Studio, Copilot Agents, and Kyndryl Bridge AI services to enable autonomous detection and response orchestration.
• Develop conversational interfaces and chatbot visual layers within Power BI and SOC portals for interactive, AI-guided analytics.
• Ensure AI systems follow Responsible AI practices, including explainability, fairness, and human-in-the-loop controls.
• Work closely with Data Scientists and AI Engineers to align GenAI capabilities with SOC goals and regulatory standards.

• Partner with SOC Leads, Incident Managers, and Content Developers to integrate automation with existing playbooks and IR procedures.
• Collaborate with Platform Engineers to maintain high performance and availability of SOAR and analytics systems.
• Contribute to SOC governance meetings, sharing insights on automation KPIs, GenAI outcomes, and CSI (Continual Service Improvement) recommendations.
• Maintain alignment between automation/AI initiatives and business objectives, cybersecurity frameworks, and compliance requirements.

• 3+ years of experience in SOC Operations, Automation, or AI Engineering, preferably in large-scale or MSSP environments.
• Proven hands-on expertise in:
  
  
  • Microsoft Sentinel SOAR and Azure Logic Apps
  • Power BI (Service, Desktop, DAX, and Power Query)
  • Experience with incident lifecycle automation, SIEM-to-ITSM integration, and multi-step orchestration.
• Familiarity with predictive analytics, anomaly detection, and GenAI prompt engineering.
• Strong understanding of SOC metrics, SLAs, and KPI tracking.
• Knowledge of data visualization, model monitoring, and AI ethics principles.

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or other related fields
• Preferred Certifications in Cyber Security: ECTHP (Certified Threat Hunting Professional) or ECMAP (Malware Analysis Professional)
• Experience in security monitoring and in advanced analytics (UEBA)