2 months ago
Base Salary
$117k - $158k/yr
Responsibilities
- Design and maintain SOAR playbooks and orchestration workflows for triage, enrichment, containment, and response.
- Apply AI/ML and LLM-assisted techniques to alert summarization, investigation assistance, enrichment, and anomaly scoring.
- Build Python-based integrations and APIs across SIEM, SOAR, EDR, ticketing, threat intelligence, and cloud platforms.
- Develop and tune SIEM correlation rules, alerts, and detection use cases mapped to MITRE ATT&CK.
- Administer SIEM data onboarding, index and data model health, log ingestion monitoring, and configuration management.
- Create field extractions, parsers, content packs, dashboards, and reporting for detection and automation operations.
- Improve signal-to-noise ratio, reduce false positives and MTTR, and manage detection content and playbooks as versioned, testable code.
- Evaluate and pilot automation, orchestration, and AI tooling for detection and response.
Requirements
- 5+ years of experience building automation, orchestration, or SOAR playbooks in a cybersecurity or SOC environment.
- 3+ years of SIEM engineering or administration experience, including data onboarding, correlation rule development, and platform configuration.
- Strong Python or comparable scripting skills and experience building APIs and integrations across security and IT tooling.
- Hands-on experience applying AI/ML or LLM-based tooling to security use cases; experience building these capabilities is strongly preferred.
- Working knowledge of MITRE ATT&CK and experience mapping detections or automation to adversary tactics and techniques.
- Experience with a SOAR or security orchestration platform such as NG-SIEM Fusion, Splunk SOAR, Palo Alto XSOAR, Tines, or similar.
- Cloud security experience with AWS, Azure, or GCP, including automation for ingesting and processing cloud security data.
- Experience with CI/CD, infrastructure-as-code, and version control for detection and automation content.
- Familiarity with containerized and serverless environments and their automation and logging considerations.
- SIEM, SOAR, or security automation platform certification is preferred.
- Regulatory compliance experience is a plus.
Benefits
- Medical, dental, and vision insurance.
- Remote-flexible workforce.
- Wellness programs.
- 401(k) program with employer match.
- Flexible paid time off.
- Generous parental leave.
- Donations for Doers program.
- Pet insurance, legal protection, and identity protection.
- Tuition reimbursement program.
Tech Stack
Categories
About Blackbaud
Blackbaud builds cloud software for nonprofits, schools, arts and cultural institutions, healthcare, and corporate social impact teams, spanning fundraising CRM, digital giving, grantmaking, financials, and education management. Its portfolio includes SaaS products such as Raiser's Edge NXT, Financial Edge NXT, and platforms like JustGiving and YourCause. Founded in 1981 and headquartered in Charleston, South Carolina, Blackbaud is a public company traded on the NASDAQ (BLKB).