Security Automation Engineer

About this job

WPP serves as a trusted growth partner for leading global brands, uniting data solutions, creativity, production, and strategic counsel through exceptional talent and the WPP Open platform. As a Security Automation Engineer based in Chennai, you will join the Operational Security team to design, build, and maintain automation solutions that improve threat detection, incident response, and workflow efficiency. Reporting to the Automation Lead, your day-to-day work involves developing SOAR playbooks, writing Python or PowerShell scripts, integrating security tools via REST APIs, and building AI-assisted workflows. You will collaborate with detection engineering, incident response, and threat intelligence teams to turn standard operating procedures into automated pipelines. Through these efforts, you help reduce manual workloads, support the Autonomic Security Operations model, and enable the company to maintain consistent, reliable, and auditable operational security standards across its global network.

Responsibilities

• Develop SOAR playbooks, workflows, and automations for alert triage, enrichment, containment, and remediation.
• Build scalable automation components, scripts, and integrations using Python, PowerShell, and REST APIs.
• Integrate SOAR platforms with SIEM, EDR, TIP, cloud-native security tools, and case management systems.
• Contribute to embedding AI/ML-driven enrichment and correlation logic into automated security workflows.
• Translate SOPs, response runbooks, and detection workflows into automated, consistent, and auditable processes.
• Collaborate with Detection Engineering, Incident Response, and Threat Hunting teams to automate use cases.
• Monitor performance and exceptions of automation systems to ensure ongoing reliability and accuracy.

Requirements

• Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, or Chronicle SOAR.
• Proficiency in Python and/or PowerShell for automation development.
• Strong understanding of REST APIs, JSON, and event-driven automation.
• Experience integrating SIEM, EDR, TIP, and cloud-native security tools.
• Understanding of workflows across SOC, Incident Response, Threat Hunting, and Detection Engineering.
• Ability to convert operational requirements and standard operating procedures into engineered automation.
• Strong communication and documentation skills with an engineering-first mindset.

Good to have

• SOAR platform certifications
• GIAC certifications including GMON, GCTI, GCIH, or GCDA
• Python or scripting certifications
• Azure or GCP cloud certifications

Who should apply

This role suits professionals with a strong background in security operations, automation engineering, and script development who enjoy building scalable technical solutions. Candidates should possess hands-on experience with SOAR platforms and programming languages like Python or PowerShell. Individuals who excel at collaborating across cross-functional security teams, converting manual processes into streamlined workflows, and applying an engineering-first mindset will find this position a great fit. The posting does not mention whether freshers can apply.

Frequently asked questions