Job description

Security incidents move faster than manual response can keep up with, and closing that gap through orchestration and automation is the core purpose of this FortiSOAR Specialist role. You will serve as the primary technical and operational Subject Matter Expert (SME) for automation, integration, and playbook development, working closely with Cyber Engineering, Cyber Defense, Platforms & Architecture, and Service Delivery teams. New logging sources need integrating and playbooks need developing to triage and respond to security incidents, cutting investigation and response times wherever possible. Simple and complex playbooks, standard and custom connectors, and integrations between FortiSOAR and various security and IT technologies all fall under this remit. FortiSOAR gets deployed, configured, managed, operated, and monitored within a Security Operations Center (SOC) environment, including virtual machines across dedicated, on-premises, cloud, and multi-tenant environments. Dashboards, reports, incident war rooms, and roster management need configuring, and Jinja filters, functions, and conditions get defined and implemented as part of the build. Customer security teams look to this role for guidance on SOAR best practices, and pre-sales, sales, and business development activities get supported alongside day-to-day delivery. SLAs, KPIs, and OLAs get tracked and reported on, and incidents, problems, issues, risks, and compliance activities get initiated, supported, and managed throughout. Participation in 24x7 on-call support for critical or urgent activities is expected, reflecting how central this role is to incident response.