Lead Security Automation Consultant – SOAR, Azure

Trility Consulting

. Design, develop, and implement security automation workflows across defined client use cases .

Posted 11/3/2026contractRemote • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security automation and systems integration, with strong capabilities in Python development, Azure Functions, and REST API integrations. Proficient in utilizing Kusto Query Language (KQL) for security data analysis and implementing Azure DevOps pipelines for deployment.

Highest-signal resume keywords

Security Automation SolutionsPython DevelopmentKusto Query Language (KQL)REST API IntegrationsAzure DevOps Pipelines

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security AutomationPythonAzure FunctionsKusto Query Language (KQL)REST APIsMicrosoft GraphAzure DevOpsTinesServiceNow IntegrationSecurity Orchestration

Soft Skills

Problem-SolvingCommunicationDocumentationKnowledge Sharing

Tools & Technologies

Microsoft Entra IDMicrosoft SentinelTinesTorqSwimlaneSplunk SOARCortex XSOARAzure Logic AppsPower AutomateN8n

Industry Keywords

Security EngineeringSystems IntegrationChange-Control ProcessesIncident Data ManagementVulnerabilities and Exposures (CVE)

Tech Stack

Tools & technologies

AzurePythonServiceNowSplunk

About the role

Key responsibilities & impact

Design, develop, and implement security automation workflows across defined client use cases
Build integrations between security platforms, ServiceNow, and other enterprise applications using REST APIs and Microsoft Graph
Develop and maintain Python-based Azure Functions
Build and work with KQL queries, particularly Microsoft Defender advanced hunting, to retrieve, filter, and analyze security data
Develop automated workflows using Tines or comparable security orchestration and automation platforms
Integrate security alerts, incident data, and case-handling processes with ServiceNow
Use Microsoft Entra ID for identity-related automation, including group membership changes and application registration credentials
Implement Azure DevOps pipelines to deploy Azure Functions and support controlled release processes
Follow client change-control and approval processes
Troubleshoot, test, and optimize automation workflows and integrations
Build reusable components, develop supporting runbooks, and lead knowledge-transfer sessions
Collaborate with client stakeholders to understand requirements and translate them into practical automation solutions

Requirements

What you’ll need

Must reside within the United States
Must be authorized to work in the United States without sponsorship now or in the future
Must be able to pass a background check
5+ years of experience in security engineering, security automation, systems integration, or a related technical discipline
Hands-on experience designing and implementing security automation or workflow automation solutions
Strong Python development experience, including building and deploying Azure Functions
Experience writing and working with Kusto Query Language (KQL), particularly Microsoft Defender advanced hunting
Experience integrating ServiceNow with security platforms or other enterprise applications
Strong experience building and consuming REST APIs and developing application integrations
Experience with Microsoft Graph and Microsoft Entra ID, including automating group membership changes and working with application registration credentials
Experience implementing Azure DevOps pipelines to deploy Azure Functions
Experience working within structured change-control and approval processes
Experience with a security orchestration or workflow automation platform such as Tines, Torq, Swimlane, Splunk SOAR, Cortex XSOAR, or Microsoft Sentinel Playbooks/Azure Logic Apps
Ability to independently develop, troubleshoot, and deliver working automation solutions within a defined project timeline
Strong problem-solving, communication, documentation, and knowledge-sharing skills
Direct, hands-on experience with Tines (preferred)
Experience with Microsoft Sentinel and Sentinel playbooks (preferred)
Experience with Defender for Office 365 or Proofpoint email and click data (preferred)
Experience working with Tenable and Common Vulnerabilities and Exposures (CVE) data (preferred)
Experience integrating or working with Hunters security platform (preferred)
Familiarity with n8n, Power Automate, Workato, or other workflow automation platforms (preferred)
Experience building security triage, ticketing, and case-management workflows (preferred)
Experience working in a consulting or professional services environment (preferred)

Benefits

Comp & perks

Work remotely anywhere in the United States with flexible work hours
Sponsored and supported learning opportunities
Great Place to Work® Certification culture
Short-term 1099 contract engagement