Cybersecurity Lead

Virtusa · Colombo

Automation Development: Design and optimize security automation workflows using Torq Hyperautomation or other SOAR platforms (XSOAR, Splunk SOAR, LogicHub, or Swimlane).
System Integration: Build robust API integrations connecting security tools, including SIEMs, EDRs, XDRs, case management systems, and cloud environments.
Data Transformation: Work extensively with JSON formatting, parsing, and complex data transformations to ensure seamless communication across security platforms.
Incident Response Optimization: Streamline automated response actions to improve operational efficiency, reduce MTTR, and enhance event correlation.
Scalable Architecture: Design and maintain fault-tolerant automation processes capable of scaling across a vast client base.
Infrastructure Management: Optimize and maintain CI/CD pipeline infrastructure specifically within SOAR environments.
Cross-Functional Collaboration: Partner with SOC analysts, DFIR teams, and threat intelligence groups to refine automation capabilities.
Migration Leadership: Lead platform migration projects, ensuring smooth transitions that do not disrupt active security operations.
Innovation: Continuously evaluate and implement emerging techniques to enhance SOC and MSSP workflows.

Experience: 1+ years in security automation, SOAR engineering, or cybersecurity automation within an MSSP, DFIR, or enterprise environment.
Technical Proficiency: Deep expertise in JSON, including schema design, manipulation, and API-based data transformations.
Scripting: Strong skills in Python, PowerShell, or Bash for high-level workflow automation.
API Development: Proficient in RESTful APIs, JSON-based APIs, and webhook-driven automation.
Tooling Knowledge: Experience with SIEMs (Splunk, Sentinel, QRadar) and EDR/XDR platforms (CrowdStrike, SentinelOne, Cortex XDR).
Cybersecurity Fundamentals: Solid understanding of incident response, threat intelligence, and the security event lifecycle.

Environment: Prior experience in multi-client MSSP settings or dedicated Incident Response (IR) firms.
Specialized Platforms: Hands-on experience with Torq Hyperautomation or XSOAR.
Certifications: Torq SOAR Analyst/Expert, CompTIA Security+, or AWS/Azure Security certifications.
Advanced Tools: Proficiency with JQ filters for data manipulation and familiarity with Azure DevOps for CI/CD.
Cloud Security: Experience automating workflows within AWS, Azure, or Google Cloud.
Project Leadership: Background in leading SOAR migrations or developing sophisticated custom security playbooks.

Location: Colombo, Sri Lanka

To apply for this job please visit lk.linkedin.com.