Lead Engineer, Cyber Defense Automation
TransUnion1 day ago
Bengaluru, IndiaStaff+
Responsibilities
- Design, build, and maintain security-response automations and migrate existing Splunk SOAR playbooks.
- Build agentic workflows covering prompt and agent design, tool integration, guardrails, output evaluation, and human-in-the-loop review.
- Develop integrations across SIEM, EDR, threat intelligence, case management, and ITSM systems using REST APIs, webhooks, and event-driven patterns.
- Build internal tools, services, and APIs primarily in Python to extend platform capabilities and reduce analyst toil.
- Administer and improve case-management workflows and operationalize new detections into automated response.
- Contribute to Git-based engineering standards, code review, testing, and CI/CD.
- Measure automation throughput, MTTR, false-positive burden, and analyst time saved.
- Write documentation and runbooks and collaborate with a global distributed team.
Requirements
- 5+ years of experience in security engineering, security automation, or software engineering with a strong security focus.
- Strong production Python skills and command of REST APIs, JSON, webhooks, authentication patterns, OAuth, API keys, and secrets handling.
- Hands-on experience with SOAR or security automation platforms such as Splunk SOAR, XSOAR, Tines, or Torq.
- Experience building with modern LLM platforms such as Anthropic Claude, OpenAI, or Amazon Bedrock using APIs, SDKs, tool-use patterns, prompt and agent design, and model-output evaluation.
- Knowledge of Git, code review, automated testing, and CI/CD.
- Working knowledge of SOC operations, incident-response workflows, and MITRE ATT&CK.
- Strong documentation and written communication skills in a distributed global team.
- Preferred qualifications include production agentic AI or autonomous-agent experience, LLM fine-tuning, evaluations or red-teaming, Splunk Enterprise Security, SPL, detection-as-code, ServiceNow or similar ITSM experience, FastAPI or Flask, front-end exposure, AWS, Docker, Kubernetes, Terraform, DevOps experience, and experience mentoring engineers or leading technical workstreams.
Benefits
- Hybrid work arrangement with regular virtual work and at least two days per week in an assigned TransUnion office.
- Work/life flexibility and resources supporting professional and personal well-being.
- Opportunities for professional development, skill growth, collaboration, and innovation.
Categories
About TransUnion
TransUnion is a global credit bureau and information-services company that provides credit data, identity verification, fraud prevention, and risk analytics to businesses and consumers. It sells data, APIs, and decisioning software used by lenders, insurers, telecoms, and other regulated industries, and offers consumer credit reports and monitoring. Founded in 1968 and headquartered in Chicago, it operates in more than 30 countries and is publicly traded on the NYSE under the ticker TRU.