Description
Mastercard is seeking a Lead Response Technology and Automation Security Engineer to help drive its Security Operations modernization strategy.
The ideal candidate is passionate about modern security tools, capabilities, and strategies. The RESPOND product team executes on the multi-year strategy and roadmap set by the RESPOND product owner to evolve and modernize SecOps incident investigation and response technology, capabilities, tools, and process.
Core Responsibilities
- Execute the RESPOND product roadmap in close partnership with SOC and Incident Response teams in the region.
- Design, build, test, and maintain SOAR playbooks used for incident triage and response scopes to collect and process digital evidence and artifacts at speed and scale.
- Build and operationalize AI-augmented response capabilities, including agentic AI workflows integrated into triage, enrichment, and response.
- Define strategic requirements and oversee management for connectors, apps, and integrations between SOAR, SIEM, EDR, identity, ticketing, threat intelligence, and AI/LLM platforms.
- Build and maintain response tooling: scripts, live-response packages, enrichment services, and automation utilities deployable via EDR and SOAR.
- Embed with SOC and DFIR analysts to identify high-toil workflows and convert them into automated, AI-assisted, or fully autonomous playbooks with appropriate guardrails.
- Tune and optimize playbooks and AI-assisted workflows against measurable outcomes (MTTR, false-positive rate, analyst touch time, AI-assist accuracy).
- Contribute to the centralized response tooling, prompt book, and notebook libraries, ensuring code quality, documentation, version control, and reusability across regions.
- Support major incident response activities by deploying and operating response tooling and AI-assisted investigation workflows under pressure.
- Provide feedback into the product backlog and partner with the PO on requirements refinement.
- Document playbooks, prompt books, notebooks, and technical designs to enterprise standards.
Requirements
- 5+ years in security operations, incident response, detection engineering, or security automation engineering
- Prior experience as a SOC analyst, Security Engineer, Digital Forensics Examiner, SOAR engineer, and/or threat hunter preferred
- Hands-on SOAR development experience with low-code/no-code or hyper-automation tools and concepts
- Demonstrated enterprise experience executing on AI-augmented SOC concepts
- Strong scripting skills in Python and PowerShell
- Working knowledge of REST APIs, JSON, webhooks, and authentication patterns (OAuth, API keys, managed identities)
- Solid grounding in incident response fundamentals and the IR lifecycle
- Hands-on experience with EDR platforms, SIEM, identity platforms, cloud platforms, and cloud protection products
- Familiarity with MITRE ATT&CK and the ability to map response actions to adversary techniques
Preferred Qualifications
- Bachelor’s degree in computer science, cybersecurity, or IT-focused disciplines (or equivalent experience)
- At least two Industry certifications: GCFA, GCIH, GNFA, GCFR, GREM, or equivalent
- Experience with SecOps focused MCP server architectures, agentic frameworks, or tools
- Experience building EDR live-response scripts and tool libraries
- Exposure to detection-as-code and response-as-code practices, including CI/CD for security content
- Background in regulated financial services or Fortune 500 SOC environments