New opportunity

Lead Response Technology and Automation Security Engineer

Mastercard · Pune, India

About this role

The Corporate Security Threat and Response Management product ownership team at Mastercard is looking for a Lead Level Security Engineer to help drive our Security Operations modernization strategy. The RESPOND product team executes on the multi-year strategy and roadmap to evolve and modernize SecOps incident investigation and response technology, capabilities, tools, and process.

Responsibilities

Execute the RESPOND product roadmap in close partnership with SOC and Incident Response teams in the region.
Design, build, test, and maintain SOAR playbooks used for incident triage and response scopes to collect and process digital evidence and artifacts at speed and scale.
Build and operationalize AI-augmented response capabilities, including agentic AI workflows integrated into triage, enrichment, and response, prompt books and prompt libraries tuned for SOC and Incident Response use cases, prompt-book/code notebook development for repeatable investigation, hunt, and DFIR workflows, and LLM-driven enrichment and summarization integrated into case management.
Define strategic requirements and oversee management for connectors, apps, and integrations between SOAR, SIEM, EDR, identity, ticketing, threat intelligence, and AI/LLM platforms for build through our dedicated engineering partners.
Build and maintain response tooling such as scripts, live-response packages, enrichment services, and automation utilities deployable via EDR and SOAR.
Embed with SOC and DFIR analysts to identify high-toil workflows and convert them into automated, AI-assisted, or fully autonomous playbooks with appropriate guardrails.
Tune and optimize playbooks and AI-assisted workflows against measurable outcomes including MTTR, false-positive rate, analyst touch time, and AI-assist accuracy.
Contribute to centralized response tooling, prompt book, and notebook libraries, ensuring code quality, documentation, version control, and reusability across regions.
Support major incident response activities by deploying and operating response tooling and AI-assisted investigation workflows under pressure.
Provide feedback into the product backlog and partner with the PO on requirements refinement, and document playbooks, prompt books, notebooks, and technical designs to enterprise standards.

Required qualifications

5+ years in security operations, incident response, detection engineering, or security automation engineering.
Hands-on SOAR development experience with low-code/no-code or hyper-automation tools and concepts.
Demonstrated enterprise experience executing on AI-augmented SOC concepts, including building and maintaining AI prompt books for analyst workflows, developing Jupyter notebooks for investigation, hunt, or DFIR, integrating LLMs or agentic AI into XDR, SOAR, case management, or response tooling, leveraging IDEs with AI connectors to process data and execute AI workflows, or deploying agent-based AI workflows for triage or enrichment in production.
Strong scripting skills in Python and PowerShell, and comfortable with basic code repo management using Git or equivalent.
Working knowledge of REST APIs, JSON, webhooks, and authentication patterns including OAuth, API keys, and managed identities.
Solid grounding in incident response fundamentals and the IR lifecycle.
Hands-on experience with EDR platforms, SIEM, identity platforms, cloud platforms, and cloud protection products.
Familiarity with MITRE ATT&CK and the ability to map response actions to adversary techniques.
Demonstrated ability to operate inside an agile delivery model with a product backlog.

Preferred qualifications

Bachelor’s degree in computer science, cybersecurity, or IT-focused disciplines (or equivalent experience).
At least two Industry certifications such as GCFA, GCIH, GNFA, GCFR, GREM, or equivalent.
Experience with SecOps focused MCP server architectures, agentic frameworks, or tools.
Experience building EDR live-response scripts and tool libraries.
Exposure to detection-as-code and response-as-code practices, including CI/CD for security content.
Background in regulated financial services or Fortune 500 SOC environments.

For full details about this role, click “Apply on company site” to view the employer’s original posting.

Skills for this role

SOARPythonPowerShellJupyterLLMAgentic AIGitREST APIsOAuthCrowdStrikeSentinelOneSplunkMicrosoft SentinelEntra IDOktaAWSAzureGCPMITRE ATT&CK

Checking your profile…

Preparation suggestions, not the employer’s actual interview questions. Always check the original posting for current requirements.

Understand the role

What matters most

Executing the RESPOND Product Roadmap
Drive security operations modernization strategy by working closely with regional SOC and Incident Response teams to translate product vision into operational reality on the ground.
Designing Scalable SOAR Playbooks
Design, build, test, and maintain automated playbooks for incident triage, digital evidence collection, and artifact processing to handle investigations at speed and scale.
Operationalizing AI-Augmented Response Capabilities
Integrate agentic AI workflows, prompt libraries, code notebooks, and LLM-driven enrichment into case management to reduce analyst toil and improve triage accuracy.
Tuning Workflows Against Measurable Outcomes
Optimize automation playbooks and AI-assisted workflows against key performance metrics including Mean Time to Resolution (MTTR), false-positive rates, and analyst touch time.

Likely challenges to think through

Balancing Autonomous AI Guardrails with Incident Accuracy
Integrating agentic AI and LLMs into live SOC triage introduces the risk of false positives or unvalidated automated actions during high-pressure incidents. Prepare by demonstrating experience with strict output validation, deterministic fallbacks, and human-in-the-loop guardrails for autonomous workflows.
Bridging Product Vision with Regional Operational Realities
As the connective tissue between product strategy and regional SOC execution, you must align centralized roadmap requirements with diverse, high-toil analyst workflows. Prepare by highlighting agile product backlog management experience and direct collaboration models with end-user security analysts.

Practice your answers

Technical practice

Designing Scalable SOAR Playbooks for Incident Triage

What to coverDiscuss how you design, test, and maintain low-code/no-code SOAR playbooks to collect and process digital evidence at scale. Address error handling, data parsing, and modular design principles to prevent playbook failures during high-volume incidents.

Integrating Agentic AI and LLMs into SecOps Workflows

What to coverExplain how you would safely incorporate agentic AI or LLM-driven enrichment into SOC triage and case management. Address validation mechanisms, guardrails against hallucinations, and methods to measure AI-assist accuracy and analyst touch time.

Developing Python and PowerShell Scripting for Response Tooling

What to coverDescribe how you write and maintain custom scripts, live-response packages, and automation utilities using Python and PowerShell. Address code version control with Git, modular utility libraries, and safe execution via EDR platforms.

Building and Utilizing Jupyter Notebooks for DFIR Workflows

What to coverExplain your approach to developing Jupyter code notebooks for repeatable threat hunting, digital forensics, and incident investigation. Discuss how code notebooks complement automated SOAR playbooks during complex investigations.

Managing API Integrations and Authentication Patterns

What to coverDiscuss how you define requirements for secure connectors and integrations between SIEM, EDR, identity providers, and AI platforms using REST APIs, webhooks, and authentication standards like OAuth and managed identities.

Mapping Incident Response Actions to MITRE ATT&CK

What to coverExplain how you map automated response actions and detection rules to specific adversary techniques within the MITRE ATT&CK framework. Provide an example of how this mapping guides playbook logic and evidence collection.

Optimizing Workflows Against Measurable SecOps Outcomes

What to coverDescribe how you tune security automation and AI-assisted workflows against key performance indicators such as Mean Time to Resolution (MTTR) and false-positive rates. Address how you identify high-toil analyst workflows to target for automation.

Operating Response Tooling Across EDR, SIEM, and Cloud Platforms

What to coverDiscuss your hands-on experience deploying and operating response tooling across EDR platforms, SIEM solutions, identity providers, and cloud environments. Address how you unify telemetry and response actions across disparate enterprise systems.

Behavioural practice

Collaborating with Regional SOC Teams on Product Roadmaps

What to coverDescribe a situation where you worked closely with operational teams to roll out a new security tool or automation strategy. Use the STAR method to explain how you gathered requirements, addressed operational feedback, and bridged product vision with on-the-ground reality.

Operating Under Pressure During Major Security Incidents

What to coverShare an example of supporting a major incident response effort while deploying and operating custom response tooling. Detail the situation, the specific actions you took to maintain composure and accuracy under pressure, and the result of your intervention.

Translating High-Toil Analyst Workflows into Automated Playbooks

What to coverGive an example of embedding with analysts to identify manual, repetitive tasks and converting them into automated or AI-assisted workflows. Describe the situation, how you collaborated with the team to establish guardrails, and the measurable efficiency gains achieved.

Partnering with Product Owners in an Agile Delivery Model

What to coverDescribe your experience working within an agile delivery model to refine product backlogs and technical requirements. Use the STAR method to outline how you provided feedback, handled shifting priorities, and ensured high engineering standards.

Sharpen your knowledge

Topics to prepare

Incident Response Lifecycle & Frameworks
Review standard IR phases, containment strategies, and mapping adversary techniques to MITRE ATT&CK. Relevance: Directly supports core responsibilities in designing triage workflows and supporting major incident response activities under pressure.
AI-Augmented SOC & Agentic Workflows
Study concepts around integrating LLMs, prompt libraries, code notebooks, and agentic workflows into security operations. Relevance: Directly aligns with the role requirement to build and operationalize AI-augmented response capabilities and prompt books.
Agile Product Backlog Management & SecOps Roadmap
Understand how security engineering aligns with product roadmaps, requirements refinement, and backlog prioritization. Relevance: Essential for partnering with product owners and executing the RESPOND product strategy.

Skills to revise

SOAR Playbook Development
Practice building, testing, and maintaining low-code/no-code SOAR playbooks for automated triage and digital evidence collection at scale. Relevance: Required for designing scalable response capabilities across EDR, SIEM, and ticketing platforms.
Python and PowerShell Scripting
Write and test scripts for custom enrichment services, automation utilities, and live-response packages. Relevance: Crucial for building and maintaining response tooling deployable via EDR and SOAR.
Jupyter Notebooks for DFIR & Investigation
Develop code notebooks for repeatable investigation, threat hunting, and digital forensics workflows. Relevance: Directly maps to the required enterprise experience in executing AI-augmented SOC concepts.
REST APIs and Webhooks Integration
Configure API integrations, authentication patterns (OAuth, API keys), and JSON payloads across security platforms. Relevance: Needed to oversee management for connectors and integrations between SIEM, EDR, identity, and AI/LLM platforms.

Your preparation checklist

Audit and Document SOAR and Scripting Portfolio
Compile examples of automated SOAR playbooks, custom Python/PowerShell scripts, and Git repositories demonstrating low-code/no-code workflows and live-response utility development.
Prepare AI-Augmented SecOps Architecture Walkthrough
Draft a structured technical walkthrough showing how you have built and maintained AI prompt books, Jupyter notebooks, or agent-based workflows for incident triage, threat hunting, and LLM enrichment.
Review Incident Response Fundamentals and MITRE ATT&CK Mapping
Refresh core IR lifecycle stages and prepare evidence of how you map automated response actions and detection rules to adversary techniques using the MITRE ATT&CK framework.
Demonstrate Integration and API Proficiency
Prepare code snippets or architectural diagrams illustrating REST API integrations, webhooks, authentication patterns (OAuth, API keys, managed identities), and connectors across EDR, SIEM, and cloud platforms.
Structure Agile Backlog and Metrics Optimization Examples
Prepare STAR-format examples of operating within agile delivery models, refining requirements with product owners, and tuning automation workflows against metrics like MTTR and false-positive rates.
Formulate Targeted Employer Questions
Draft thoughtful questions regarding the RESPOND product roadmap, how the engineering team balances autonomous AI guardrails during major incidents, and collaboration models with regional SOC analysts.

Availability last checked: 4 Nov 2026. Status can change after a check; confirm on the employer’s website. Report an issue · Our checking policy

KEEP EXPLORING

Similar AI jobs

Related skills and specializations in India. Matched to this role, not your profile.

Explore more jobs

Finding similar opportunities…