SOAR Developer

Division: Chief Information Security Office (CISO) 

As a global critical financial infrastructure**, the protection of Euroclear information** and assets is fundamental to the company’s business. Information Security is at the core of our services, firmly embedded in the management systems and processes of the company. You will be joining our Chief Information Security Office in charge of putting in place the required controls to adequately and effectively protect our information assets.

We’re looking for a SOAR Developer to design, build, and maintain automation capabilities that strengthen our security operations.
You’ll collaborate closely with Incident Response, Threat Detection Engineering, SOC analysts, and platform teams to deliver high‑quality playbooks, integrations, and workflows.

What You’ll Do:
- Build and refine SOAR playbooks, automations, integrations, dashboards, and orchestration logic.
- Communicate and demonstrate new or updated workflows to operational teams.
- Ensure automation content is production‑ready with clear, maintainable documentation.
- Continuously monitor and optimize workflows to improve reliability, efficiency, and stability.
- Maintain and update SOAR workflows, integrations, content packs, and vendor modules.
- Promote content across environments using Git‑based version control and peer reviews.

What You Bring:
- Strong Python skills for automation and integrations.
- Experience with REST APIs (OAuth2, API keys), JSON, and common web service standards.
- Hands‑on experience with automation testing: functional, scenario‑based, regression, and integration.
- Experience managing SOAR content across multi‑stage environments (dev → integration → prod).
- Knowledge of secure development practices, logging/auditing safeguards, and safe API handling.
- Understanding of IR workflows (triage, investigation, containment). SOC/IR experience is a plus.
- Solid understanding of SIEM, EDR, logging pipelines, network/security fundamentals.
- 3+ years in SOAR engineering, security automation, SOC engineering, or IR‑related roles.
- Hands‑on experience with Palo Alto Cortex XSOAR (Demisto).

Nice to Have:
- Modular, reusable SOAR components (sub‑playbooks, automation templates).
- CI/CD experience for validation and promotion of SOAR content.
- Experience maintaining XSOAR content packs or marketplace integrations.
- Additional scripting (JavaScript, PowerShell). - Integrating SIEM and email ingestion sources (Splunk ES, MS Graph Mail API). - Integration of external platforms (EDR, Azure, ServiceNow). - Familiarity with event‑driven workflows (webhooks, async APIs, message triggers).