Security Automation and AI SOC Engineer

Salary: £45,000 - 70,000 per year

Requirements:

• Strong background in Security Operations, Incident Response, Detection Engineering, or Security Engineering.
• Demonstrable experience working in an enterprise SOC and improving security operations processes, workflows, and analyst effectiveness.
• Hands-on experience with security orchestration and automation platforms such as Torq, Tines, Swimlane, Cortex XSOAR, Microsoft LogicApps, or similar platforms.
• Experience developing automated investigations, alert enrichment workflows, response playbooks, case management integrations, or analyst productivity tools.
• Practical experience implementing AI capabilities within a SOC, including AI-assisted investigation, triage, alert analysis, or response workflows.
• Understanding of the opportunities, limitations, and risks of AI in Security Operations, with experience implementing quality control, governance, and human oversight for AI-driven workflows.
• Scripting or development experience; Python is preferred.
• Experience integrating security technologies through APIs.
• Understanding of SIEM, EDR, identity, and cloud security technologies.
• Strong analytical and problem-solving skills.
• Desirable: Experience designing an AI adoption strategy for a SOC.
• Desirable: Experience with agentic AI or autonomous security workflows.
• Desirable: Experience with Microsoft Sentinel, Splunk, or equivalent SIEM platforms.
• Desirable: Experience with Azure, GCP, or AWS cloud security technologies.
• Desirable: Experience with detection engineering and security use case development.
• Desirable: Experience building automation metrics and measuring operational efficiency.
• Desirable: Familiarity with LLMs, AI agents, and MCP.

Responsibilities:

• Design, develop, and maintain security automation workflows using platforms such as Torq, Tines, Swimlane, or similar technologies.
• Work with the SOC to identify manual, repetitive, and time-consuming activities suitable for automation.
• Develop automated triage, enrichment, investigation, and response workflows.
• Improve integrations between security tooling, ticketing platforms, asset inventories, identity systems, and collaboration platforms.
• Establish standards, documentation, and best practices for automation development.
• Track and demonstrate measurable efficiency gains from automation.
• Assess opportunities to introduce AI safely into Security Operations.
• Design and implement AI-assisted investigation, triage, and analyst support capabilities.
• Define governance, quality assurance, and human oversight models for AI-enabled security operations.
• Establish ways to measure AI effectiveness, accuracy, quality, and operational benefit.
• Help ensure AI capabilities complement analysts and shape the operating model for analysts working alongside AI agents and automation platforms.
• Develop a roadmap for Security Automation and AI adoption within the SOC.
• Identify which activities should remain human-led and which should become automated or AI-assisted.
• Build frameworks to scale automation while maintaining operational quality and managing risk.
• Recommend SOC maturity improvements and operational efficiencies.
• Engage with security analysts, engineering teams, and leadership stakeholders to support successful adoption.
• Measure automation outcomes and identify opportunities for further optimisation.
• Support knowledge sharing and capability development across the Security Operations team.
• Contribute reusable playbooks, templates, and investigation patterns.
• Stay informed about emerging practices in Security Automation, AI SOCs, and Agentic AI.

Technologies:

• Agentic AI
• AI
• AI Agents
• AWS
• Azure
• Cloud
• GCP
• Support
• MCP
• Python
• Security
• Splunk
• REST

More:

We are recruiting a Security Automation and AI SOC Engineer for a six-month contract based in London, with hybrid working and two days per week on site. The rate is £750 per day. This role will help evolve Security Operations through automation, process optimisation, and the pragmatic, governed adoption of AI. It combines technical delivery with strategic thinking and a focus on embedding the operational processes and ways of working needed for successful AI adoption in a SOC; it is not a traditional SOAR administration role. We are recruiting through Pontoon, an employment consultancy and equal opportunities employer. We use generative AI tools to support candidate screening, while final decisions are made by our hiring team.

last updated 40 week of 2026