Lead Response Technology and Automation Security Engineer

About the role

Mastercard’s Corporate Security Threat and Response Management team is seeking a Lead Response Technology and Automation Security Engineer to drive the modernization of Security Operations (SecOps). Based in Pune, you will bridge product vision and day‑to‑day SOC operations, building AI‑augmented response automation and tooling that enable rapid incident investigation and response.

Key responsibilities

• Execute the RESPOND product roadmap in partnership with regional SOC and Incident Response teams.
• Design, develop, test and maintain SOAR playbooks for incident triage, evidence collection and automated response at scale.
• Build and operationalize AI‑augmented capabilities, including agentic AI workflows, prompt libraries, and LLM‑driven enrichment and summarization.
• Define requirements and manage integrations between SOAR, SIEM, EDR, identity, ticketing, threat‑intelligence and AI/LLM platforms.
• Develop and maintain response tooling such as scripts, live‑response packages, enrichment services and automation utilities deployable via EDR and SOAR.
• Collaborate closely with SOC and DFIR analysts to identify high‑toil processes and convert them into automated or AI‑assisted playbooks with appropriate guardrails.
• Continuously tune and optimize playbooks and workflows to improve efficiency and effectiveness.

Required profile

• Proven experience leading security automation projects in a large enterprise or SOC environment.
• Strong understanding of modern SecOps tools, incident response processes and AI/LLM integration.
• Ability to translate product strategy into operational solutions and to work hands‑on with engineering partners.
• Excellent analytical mindset with a focus on reducing manual toil and improving response speed.

Required skills

• SOAR platform development and playbook authoring
• SIEM, EDR and identity management integrations
• AI/LLM technologies, prompt engineering and agentic AI workflows
• Jupyter notebooks or similar notebook‑based investigation tooling
• Scripting languages for automation (e.g., Python, PowerShell)
• Incident response and digital forensics tooling