About The Role ok to work remotely Has experience building/using MCP server Building/using Agentic agents Sumo Experience is a must Experience with Terraform Strong Coding experience Strong knowledge of Github and workactions Strong knowledge of DaC (Detection as Code) frameworks Background in SOC Operations Security Automation Engineer (Sumo Logic) The Security Automation Engineer (Sumo Logic) designs and implements automated solutions that improve the efficiency and effectiveness of security operations. This role focuses on integrating Sumo Logic into the broader detection, response, and monitoring ecosystem—reducing manual workloads, accelerating investigations, and strengthening the organization’s overall security posture. Key Responsibilities • Build and maintain automation workflows that streamline alert triage, enrichment, and incident response processes. • Develop integrations between Sumo Logic, SOAR platforms, threat intelligence feeds, and ticketing systems (e.g., ServiceNow, Jira). • Automate log ingestion, normalization, and correlation pipelines to support detection engineering. • Create and optimize Sumo Logic searches, dashboards, and alerts for real-time monitoring and anomaly detection. • Collaborate with the SOC and Incident Response teams to operationalize new detections and automate common investigative tasks. • Develop scripts and APIs to pull context from external data sources (e.g., VirusTotal, AbuseIPDB, or internal CMDBs). • Support continuous improvement of detection coverage and response workflows through automation metrics and feedback loops. • Maintain strong documentation for all automation code, playbooks, and integrations. Technical Skills • Advanced experience with Sumo Logic (log pipelines, queries, scheduled searches, alert automation, API integrations). • Strong scripting ability in Python and/or PowerShell for data manipulation and orchestration. • Familiarity with SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, or ServiceNow Security Operations). • Working knowledge of SIEM concepts — correlation rules, detection tuning, and data enrichment. • Experience with cloud security monitoring (AWS CloudTrail, Azure Sentinel, GCP Security Command Center). • Understanding of RESTful APIs and JSON-based automation workflows. • Familiarity with threat intelligence platforms and how to integrate them into detection workflows. • Knowledge of MITRE ATT&CK, NIST 800-61, and incident response automation best practices. Nice to have, working knowledge of n8n, Crowdstrike Fusion workflows, Sumo's SOAR