Professional Services Consultant – XSIAM Automation

Professional Services Consultant – XSIAM AutomationAbout TrantorTrantor Inc. is a global technology services and consulting company headquartered in Palo Alto, California, with delivery centers across the USA, Canada, and India. We partner with Fortune 500 companies and high-growth enterprises to drive digital transformation through Product Engineering, Cloud Enablement, Data & AI, Cybersecurity, Automation, and Customer Success Services.At Trantor, we work with leading technology companies and enterprise customers to design, implement, and operationalize solutions that improve security, efficiency, and business outcomes.Why Join Trantor?Trantor offers the opportunity to work on diverse, cutting-edge projects in a culture that values innovation, continuous learning, and collaboration. Enjoy the flexibility of a hybrid/remote role while contributing to impactful initiatives in a truly global organization.About the OpportunityWe are seeking a Professional Services Consultant – XSIAM Automation to join our cybersecurity Professional Services team.This is a hands-on, customer-facing technical consulting role focused on designing, implementing, and optimizing security automation and orchestration solutions using Palo Alto Networks Cortex XSIAM and Cortex XSOAR.The consultant will work with enterprise customers to assess SOC processes, identify automation opportunities, design and develop production-grade playbooks, build custom integrations, and operationalize security workflows. The role combines the technical depth of a Security Automation Engineer with the customer-facing responsibilities of a Professional Services Consultant.The ideal candidate should be equally comfortable discussing automation strategy with a customer's SOC team and writing Python code to implement a complex integration or automation workflow.Key Responsibilities1. XSIAM / XSOAR AdministrationConfigure integrations, content packs, roles, permissions, and automation components.Design scalable and maintainable automation architectures aligned with customer requirements.Perform platform health checks and troubleshoot deployment, integration, and automation issues.Support platform upgrades, maintenance, and ongoing optimization.Validate end-to-end data flow, API connectivity, authentication, and workflow execution.2. Automation & Playbook DevelopmentDesign, develop, test, and maintain production-grade automation playbooks.Automate SOC processes across:Alert triageInvestigationIOC enrichmentThreat intelligencePhishing responseContainmentRemediationITSM ticketingAnalyze manual SOC processes and transform them into scalable automated workflows.Apply best practices for modularity, error handling, approvals, exception handling, auditability, and reusability.Optimize playbooks for performance, maintainability, and operational effectiveness.Manage and deploy content packs, automation assets, dashboards, and custom layouts.3. Custom Integration & Automation DevelopmentDevelop custom integrations and automation using Python and, where applicable, JavaScript.Build custom connectors when out-of-the-box integrations are unavailable.Integrate XSIAM/XSOAR with third-party security and IT platforms.Work with:REST APIsJSONXMLOAuthAPI tokensWebhooksTroubleshoot API connectivity, authentication, data transformation, and integration issues.Develop reusable automation components to support customer-specific security workflows.The emphasis on custom connectors, Python/JavaScript, REST APIs, OAuth, JSON, and webhooks is drawn from the EE-XSOAR Automation requirements.4. Security Operations & Automation StrategyAssess customer SOC processes and identify opportunities for automation.Translate manual security operations processes into automated workflows.Develop automation strategies aligned with customer security objectives.Design workflows covering incident enrichment, investigation, response, and remediation.Work with SOC teams to improve analyst efficiency and reduce repetitive manual activities.Apply knowledge of incident response, threat intelligence, and security operations best practices.Leverage frameworks such as MITRE ATT&CK where appropriate.5. Security Ecosystem IntegrationIntegrate Cortex XSIAM/XSOAR with enterprise security and IT platforms, including:SIEMEDR/XDRIAMITSMEmail SecurityThreat Intelligence PlatformsVulnerability ManagementCloud Security PlatformsNetwork Security Platforms6. Customer Consulting & AdvisoryConduct customer discovery and requirements-gathering workshops.Understand existing SOC processes, challenges, and automation requirements.Translate business and technical requirements into practical automation solutions.Present solution designs, recommendations, implementation approaches, and trade-offs.Serve as a technical advisor to customer SOC teams and security stakeholders.Identify opportunities to improve security operations through automation and orchestration.7. Demonstrations, Training & Knowledge TransferDemonstrate playbooks, integrations, dashboards, and automation workflows to customer stakeholders.Conduct administrator and analyst training.Deliver technical workshops and enablement sessions.Develop knowledge-transfer materials to help customers manage and expand their automation environment.Support transition of implemented solutions into customer operations.8. DocumentationCreate and maintain:High-Level Design (HLD) documentsLow-Level Design (LLD) documentsArchitecture diagramsIntegration documentationPlaybook design documentationRunbooksDeployment proceduresAs-built documentationOperational proceduresMaintain clear documentation of dependencies, configurations, workflows, and customer-specific requirements.Required Qualifications5 – 12 years of experience in cybersecurity, security operations, security automation, SOAR, or Professional Services.Strong hands-on experience with Cortex XSOAR and/or Cortex XSIAM.Proven experience designing and implementing SOC automation workflows.Strong proficiency in Python.Strong knowledge of REST APIs, JSON, OAuth, API tokens, and webhooks.Experience developing custom integrations or connectors.Strong understanding of:Security OperationsIncident ResponseThreat IntelligenceSOC workflowsSecurity automationExperience integrating security platforms and enterprise IT systems.Ability to create and interpret technical design documentation.Strong troubleshooting and problem-solving skills.Excellent written and verbal communication skills.Prior customer-facing consulting or Professional Services experience.Preferred QualificationsHands-on experience with Cortex XSIAM.Experience with Cortex XDR.Experience with other SOAR platforms such as:Splunk SOAR / PhantomIBM ResilientSwimlaneTinesExperience with enterprise SIEM platforms such as:SplunkQRadarArcSightNetWitnessExperience with ServiceNow and Jira.Experience with cloud platforms such as AWS, Azure, or GCP.Knowledge of MITRE ATT&CK.Experience with threat intelligence platforms.Experience developing custom security integrations.Palo Alto Networks certifications such as:PCSAEPCDRAPCNSESpecialized Cortex XSOAR/XSIAM certificationsCISSP, CISM, GIAC, or relevant cloud/security certifications.The broader XSOAR/SIEM JD supports including SIEM, detection engineering, threat hunting, cloud platforms, and security certifications as preferred areas rather than making them mandatory.Key CompetenciesCortex XSIAM/XSOAR expertiseSecurity automation and orchestrationPlaybook design and developmentPython developmentAPI and integration developmentSOC process optimizationIncident responseStructured problem-solvingEnterprise security architectureCustomer consultingTechnical documentationTechnical presentations and knowledge transferAbility to work independently in customer environmentsProfessional AttributesStrong analytical and problem-solving skills.Customer-oriented and consultative approach.Ability to communicate complex technical concepts clearly to both technical and non-technical stakeholders.Self-driven and capable of independently managing technical workstreams.Strong attention to detail and documentation discipline.Comfortable working in complex enterprise environments.Ability to manage multiple priorities while maintaining delivery quality.Success MeasuresSuccess in this role will be measured by the ability to:Successfully deploy and operationalize XSIAM/XSOAR automation solutions.Deliver high-quality, production-ready playbooks and integrations.Successfully integrate XSIAM/XSOAR with customer security and IT ecosystems.Reduce manual SOC effort through effective automation.Improve incident response efficiency and analyst productivity.Deliver high-quality technical documentation and knowledge transfer.Drive customer adoption and satisfaction.Establish trusted relationships with customer security teams.