Security Automation Engineer

About Ironwood Digital : At Ironwood Digital , we partner with businesses around the world to turn big ideas into better outcomes through IT services that span cybersecurity, cloud, data, AI, and app development. We’re 400+ team members strong across 3 countries (we call ourselves Ironwood Digital ians)—and here’s what connects us all: A love for solving real business problems A belief in doing what’s right What’s it like to work here? You’ll keep growing. You’ll work alongside domain experts who love to share what they know. You’ll be supported, heard, and trusted to make an impact. You’ll take on projects that touch industries, communities, and lives. You’ll have the time to focus on what matters most in your life outside of work. At Ironwood Digital , you’ll be part of teams that design and deliver technology solutions solving real business challenges for our clients. With services spanning AI, Data, Application Development, Cybersecurity, Cloud & Infrastructure, and Industry Solutions, your work may involve building intelligent applications, securing business‑critical systems, or supporting cloud migrations and infrastructure modernization. Every role here contributes to shaping outcomes for global clients and driving meaningful impact. You’ll collaborate with experts across data, AI, engineering, cloud, cybersecurity, and infrastructure—solving complex problems with creativity, precision, and purpose. You’ll join a culture rooted in technology, curiosity, and continuous learning. A place where we move fast, trust you to make an impact, encourage innovation, and support your growth. Job Description: Ironwood Digital IT Solutions is seeking a highly motivated and technically skilled Security / SOAR Automation Engineer to join our global cybersecurity operations team supporting a fast-paced Managed Security Services Provider (MSSP) environment. The ideal candidate will possess strong hands-on experience in cybersecurity automation, SOAR platform engineering, SOC workflow orchestration, and security integrations across modern security ecosystems. This role is heavily focused on designing, implementing, optimizing, and scaling SOC automation capabilities to improve operational efficiency, incident response, alert enrichment, triage automation, threat intelligence utilization, and AI-driven security operations enhancements. The Engineer will work closely with SOC Operations, Security Engineering, Security Consulting, and Leadership teams to deliver automation initiatives and operational improvements while supporting a globally distributed security environment. This is a permanently remote opportunity for candidates based in India, aligned primarily to USA Eastern Time (ET) business hours, with flexibility depending on operational requirements. Key Responsibilities: SOAR Engineering & Automation Design, develop, implement, and maintain SOAR playbooks and automation workflows for SOC operations. Build scalable security orchestration workflows for: Alert triage Automated enrichment Threat intelligence correlation Incident response Containment workflows Identity-based investigations Case management Reporting automation Reporting automation Implement and maintain integrations between SOAR platforms and various security technologies using APIs, webhooks, SDKs, and custom connectors. Develop automation logic to improve SOC efficiency, reduce analyst fatigue, and accelerate Mean Time to Respond (MTTR) and Mean Time to Resolve. Support SOAR platform lifecycle management including upgrades, change management, testing, governance, RBAC, and operational maintenance. Assist with SOAR platform administration, identity & access management, and environment hardening. Security Platform Integrations Hands-on experience integrating and automating workflows involving: Microsoft Defender for Endpoint (MDE) Microsoft Defender XDR Microsoft Defender for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDCA) Microsoft Purview Microsoft Identity Protection / Entra ID CrowdStrike Falcon Threat Intelligence platforms (Must have) SIEM platforms (Microsoft Sentinel & Defender XDR) Graph API Ticketing platforms (Datto Autotask preferred) Email security solutions Endpoint detection & response platforms Identity and authentication platforms Cloud security solutions SOC Operations Enhancement Work collaboratively with SOC Managers, SOC Team Leads, Analysts, and Security Consultants to identify automation opportunities. Create operational enhancements to improve detection engineering, investigation workflows, escalation efficiency, and reporting. Assist with scaling SOC operations using automation and AI-driven initiatives. Support operational maturity improvements within the SOC environment. Participate in incident response automation strategy discussions and implementation planning. Contribute to SOC transformation initiatives focused on operational scalability and service optimization. AI & Advanced Security Operations Contribute to AI-enable