SOC Automation Analyst

Job Description

Build and enhance SOC workflow automation using Microsoft Logic Apps, reducing repetitive manual work for security analysts.Use Microsoft Security Copilot to identify opportunities to streamline and automate security investigation and response workflows.Leverage GitHub Copilot to accelerate scripting, development, and creation of new security automations.Automate processes across the SOC, including alert handling, enrichment, investigation workflows, escalation, and response activities.Develop and maintain automated security workflows and playbooks that integrate Microsoft's security ecosystem with other security platforms.Work within Cortex XSOAR where applicable to build, enhance, or integrate automated security orchestration workflows.Help evolve the SOC toward a more agentic environment, identifying manual analyst activities that can be handled or supported through AI-driven automation.Partner directly with SOC and cybersecurity teams to understand existing manual processes, identify automation opportunities, and translate them into scalable workflows.Test, troubleshoot, and continuously improve existing automations to ensure workflows are reliable and are actually reducing manual effort.

Skills and Requirements

• 5+ years experience working within automation or cybersecurity-1.5+ years of hands-on automation experience within a Security Operations Center (SOC) environment
• Strong SOC / security operations background with an understanding of how alerts, incidents, investigations, and response workflows operate.
• Hands-on experience with Microsoft Logic Apps, specifically building and automating security-related workflows.
• Experience with Microsoft Security Copilot and using AI to support or enhance security operations and analyst workflows.
• Hands-on experience with GitHub Copilot to assist with scripting, development, and security automation.
• Strong experience automating manual SOC processes and workflows, rather than simply monitoring or responding to alerts.
• Comfortable working within a heavily Microsoft-based security environment.
• Strong scripting and integration skills with the ability to connect different security tools and automate workflows across platforms.
• Experience with Cortex XSOAR and security orchestration / SOAR automation.
• Experience helping an organization move from traditional manual automation toward a more agentic / AI-enabled SOC environment.
• Experience using AI or agent-based automation to improve security operations.
• Must be available to come on site 2x days per week downtown Toronto
• Experience working a major Canadian bank
• Exposure to Microsoft Sentinel or other Microsoft security products.
• Experience working with APIs and integrating security platforms.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to