Detection & Response Automation Engineer

About the Role

The Detection and Response Automation Engineer is part of CGI's Global Security Operations Center (GSOC), providing 24/7 security monitoring, threat detection, and incident response. This role focuses on delivering security automation solutions to enable rapid response to evolving threats and support CGI Corporate Services in protecting corporate technology platforms. The primary responsibility is the integration of the Security Orchestration, Automation and Response (SOAR) platform with enterprise security services and increasing automation of manual processes through playbook development.

Key Responsibilities

• AI Automation:
• Design, develop, and maintain AI powered tools for security monitoring, detection engineering, incident response, and threat hunting.
• Build intelligent assistants, AI agents, copilots, and automation workflows using Large Language Models (LLMs), Generative AI, and modern agentic AI frameworks.
• Develop AI solutions to automate alert triage, investigation workflows, evidence collection, reporting, and knowledge retrieval.
• Collaborate with Security Monitoring, Incident Response, Detection Engineering, Threat Intelligence, and Security Engineering teams to identify AI-driven improvement opportunities.
• Security Automation Playbook Management:
• Document and maintain technical aspects of orchestration and automation playbooks.
• Collaborate with Global Security Shared Services (GSSS) and Global Security Operations Center (GSOC) teams on advanced threat knowledge implementation.
• Maintain playbook lifecycle across development, testing, and production environments using version control, CI, and CD.
• Security Orchestration, Automation and Response Platform Support:
• Act as Subject Matter Expert (SME) for the evolution of the SOAR platform.
• Review new platform features and provide feedback on innovation.
• Collaborate with service providers for platform hosting, infrastructure support, and orchestration component configuration to ensure synchronization of production and deployment instances.

Requirements & Tech Stack

• Skills: Splunk SOAR
• AI Knowledge: Large Language Models (LLMs), Generative AI, prompt engineering, and AI application development.
• AI Development Frameworks: Experience developing AI applications using frameworks such as LangChain, Semantic Kernel, AutoGen, OpenAI SDKs, Microsoft AI Foundry, or similar.
• SOAR Platforms: Experience with Security Orchestration, Automation and Response (SOAR) platforms such as Palo Alto Cortex Demisto, Fortinet FortiSOAR, Splunk Phantom, Splunk SOAR, or equivalents.
• Security Operations Experience: Experience in security operations roles (e.g., security analyst, security application engineer, security application support, security content engineer).
• Global Security Operations Knowledge: Knowledge of delivering security monitoring detection and response within a global organization.
• Security Operations & Development: Knowledge of security operations and secure application development.
• API Interaction: Experience interacting with web APIs such as REST, GraphQL, or SOAP.
• Software Development Workflows: Experience with modern software development workflows using tools such as Git, Gitlab, GitHub, Jira, or equivalents.

Qualifications

• Education: Bachelor's degree in Computer Science, Artificial Intelligence, Cyber Security, Software Engineering, Information Technology, or a related discipline, or equivalent practical experience.
• Certifications (Desirable):
• Microsoft AI 102: Azure AI Engineer Associate
• Microsoft AI 900: Azure AI Fundamentals
• CompTIA Security+
• CISSP
• AWS Certified AI Practitioner
• Google Cloud Professional Machine Learning Engineer
• IBM AI Engineering Professional Certificate