Lead Security Automation Consultant (SOAR / Azure) (copy)

Role overview Lead a short-term client engagement to design and deliver security automation workflows that connect security, identity, and case-management systems. The work is hands-on and spans Python development, Azure services, APIs, and orchestration, with an emphasis on dependable solutions that client engineers can maintain and extend.

Responsibilities - Build and integrate workflows for security alerts, incident data, triage, case handling, and notifications. - Develop Python-based Azure Functions and connect them to services using REST APIs and Microsoft Graph. - Automate identity tasks, including group membership updates and application credential workflows. - Create Azure DevOps deployment pipelines and follow established review, approval, and change-control processes. - Test, troubleshoot, and improve workflow reliability; document reusable components and operating procedures. - Coordinate with stakeholders, then transfer knowledge to client engineers.

Requirements - At least five years of experience in security engineering, security automation, systems integration, or a related field. - Practical experience building security or workflow automation, with strong Python skills and experience deploying Azure Functions. - Experience with Kusto Query Language, especially security hunting queries, and with Microsoft Entra ID and Microsoft Graph. - Experience integrating ServiceNow or comparable enterprise applications through REST APIs. - Experience deploying Azure Functions through Azure DevOps and working within formal change and approval processes. - Familiarity with a security orchestration platform such as Tines, Torq, Swimlane, Splunk SOAR, Cortex XSOAR, or Sentinel Playbooks; able to deliver independently and communicate clearly.

Nice to have Hands-on Tines experience; familiarity with Microsoft Sentinel, email security and click data, vulnerability or CVE data, Hunters, or workflow tools such as n8n, Power Automate, and Workato. Experience designing security triage or case-management workflows, or working in consulting, is also useful.

Benefits and work setup This is a remote, US-based 1099 contract expected to last about six weeks, from mid-December 2026 through late January 2027. Applicants must reside in the United States, be authorized to work there without current or future sponsorship, and pass a background check. Flexible hours and supported learning opportunities are offered.