Security Automation Engineer

Salary: $78000 - 146000 per year Requirements: We typically look for a post-secondary degree in Computer Science, Engineering, Information Systems, Information Security, or a related field. We require 2 to 4 years of relevant experience in security automation, AI-enabled software development, or detection engineering. We need proven capability to build and deliver automation solutions end to end. We value hands-on experience integrating systems through APIs, including REST/JSON and authentication patterns. We expect practical GitHub experience, including branching, pull requests, and collaborative development. We look for regular use of GitHub Copilot or similar AI coding tools. We need the ability to thrive in ambiguous, fast-changing environments while still delivering results. We consider experience designing AI-driven workflows or agent-style systems a strong asset. We value understanding of prompt design, structured outputs, and orchestration patterns such as validation loops, retries, and fallbacks. We prefer candidates who can combine AI capabilities with deterministic logic using Python, rules, and validation layers. We value strong judgment in deciding when AI adds value and when it introduces risk or unnecessary cost. Responsibilities: We design, build, and oversee end-to-end automation that improves detection through enrichment, triage, response, containment, and auto-closure. We work across security platforms such as ServiceNow, Splunk ES, and CrowdStrike to improve signal quality and reduce response and containment times. We create AI-assisted workflows that blend LLM-generated steps with deterministic logic for dependable operation across multiple systems. We develop multi-step, agent-like flows that enrich alerts, validate data, and support automated triage decisions. We apply detection-as-code practices, including version control, CI/CD, testing, validation, and peer review. We collaborate with detection engineers and SOC analysts to operationalize detections and improve triage speed and response consistency. We use GitHub Copilot daily to accelerate development and prototyping. We make sound decisions about when to use LLM-based solutions versus traditional code, ensuring outputs remain reliable, auditable, and repeatable. We collaborate through GitHub as the single source of truth, including repositories, pull requests, code reviews, shared libraries, reusable patterns, and workflow templates. We reverse-engineer APIs and integrations when documentation is incomplete. We solve integration challenges involving OAuth, tokens, pagination, retries, rate limits, data normalization, and enrichment. We help build and maintain an automation library and a stable automation platform. We design workflows that remain resilient despite API failures, partial data, and third-party instability. Technologies: AI API CI/CD Copilot GitHub Support JSON LLM OAuth Python REST Security ServiceNow Splunk Network More: We are building a modern, automation-first Security Operations capability focused on real-time cyber threat detection and response, where most alerts are automatically enriched, triaged, or resolved with minimal analyst intervention. Our team is focused on reducing investigation time and giving SOC analysts richer alerts so they can spend more time hunting real threats. We favor practical delivery over perfect initial solutions, using SOAR, Power Automate, and GitHub Copilot to experiment and ship high-impact work quickly. This role is based at 100 King Street West. We offer a competitive salaried pay range of $82,800 to $154,800, along with a broader compensation package that may include performance incentives, discretionary bonuses, health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. At BMO, we are guided by our purpose to boldly grow the good in business and life, and we foster an inclusive, equitable, and accessible workplace where our people are valued, supported, and able to grow from day one. last updated 28 week of 2026