Base Salary
$117k - $158k/yr
Responsibilities
- Design and maintain SOAR playbooks and orchestration workflows for triage, enrichment, containment, and response.
- Apply AI/ML and LLM-assisted techniques to alert summarization, investigation assistance, enrichment, and anomaly scoring.
- Build Python-based integrations and APIs across SIEM, SOAR, EDR, ticketing, threat intelligence, and cloud platforms.
- Develop and tune SIEM correlation rules, alerts, and detection use cases mapped to MITRE ATT&CK.
- Administer SIEM data onboarding, index and data model health, log ingestion monitoring, and configuration management.
- Create field extractions, parsers, content packs, dashboards, and reporting for detection and automation operations.
- Improve signal-to-noise ratio, reduce false positives and MTTR, and manage detection content and playbooks as versioned, testable code.
- Evaluate and pilot automation, orchestration, and AI tooling for detection and response.
Requirements
- 5+ years of experience building automation, orchestration, or SOAR playbooks in a cybersecurity or SOC environment.
- 3+ years of SIEM engineering or administration experience, including data onboarding, correlation rule development, and platform configuration.
- Strong Python or comparable scripting skills and experience building APIs and integrations across security and IT tooling.
- Hands-on experience applying AI/ML or LLM-based tooling to security use cases; experience building these capabilities is strongly preferred.
- Working knowledge of MITRE ATT&CK and experience mapping detections or automation to adversary tactics and techniques.
- Experience with a SOAR or security orchestration platform such as NG-SIEM Fusion, Splunk SOAR, Palo Alto XSOAR, Tines, or similar.
- Cloud security experience with AWS, Azure, or GCP, including automation for ingesting and processing cloud security data.
- Experience with CI/CD, infrastructure-as-code, and version control for detection and automation content.
- Familiarity with containerized and serverless environments and their automation and logging considerations.
- SIEM, SOAR, or security automation platform certification is preferred.
- Regulatory compliance experience is a plus.
Benefits
- Medical, dental, and vision insurance.
- Remote-flexible workforce.
- Wellness programs.
- 401(k) program with employer match.
- Flexible paid time off.
- Generous parental leave.
- Donations for Doers program.
- Pet insurance, legal protection, and identity protection.
- Tuition reimbursement program.
Tech Stack
Categories
About Blackbaud
Blackbaud is the world’s leading provider of AI-powered solutions for social impact. We empower the people and institutions changing the world—accelerating human progress and building a future where resources move at the speed of need. We serve nonprofits, K–12 schools, higher education, arts and cultural organizations, healthcare, corporate impact teams, and individual changemakers with intelligent solutions for giving, connecting, and engaging. Our responsible, purpose-built AI engine is fueled by the world’s largest philanthropic dataset and embedded directly into the workflows teams rely on, from fundraising and nonprofit financial management to digital giving, grantmaking, and education management. With the deepest expertise, the most connected solutions, and the largest impact network, Blackbaud helps organizations achieve what wouldn’t be possible alone. We bring clarity to complex decisions and scale to the flow of resources between organizations and the millions of individuals who support them through donations, workplace giving, and more. Trusted by millions of users, Blackbaud technologies, including YourCause® and JustGiving, help power more than $100 billion in donations, grants, and investments each year, helping the people and institutions doing mission‑driven work build momentum with confidence. Learn more at www.blackbaud.com