Resident Consultant (FortiSOAR Specialist)

Summary

The Resident Consultant (FortiSOAR Specialist) integrates new security logging sources, develops playbooks, and manages FortiSOAR in a Security Operations Center (SOC) environment. The role enhances security-incident response and improves security-team efficiency through orchestration, automation, and incident management.

Main Responsibilities

• Integrate new logging sources and build playbooks for incident response.
• Deploy, configure, manage, and monitor FortiSOAR in dedicated and cloud environments.
• Identify and address customer security-team challenges and advise on SOAR best practices.
• Design and implement dashboards, reports, and incident-management processes.
• Support pre-sales, sales, and business development of services.
• Document processes and workflows; track service-level agreements (SLAs) and key performance indicators (KPIs).
• Manage incidents, risks, and compliance activities, including 24x7 on-call support.

Key Requirements

• Bachelor’s Degree in Computer Science, Information Systems, or a related field.
• Depth of skills in at least three of the following areas: security controls operations, cyber incident response, cybersecurity detection, managed services integration, cyber threat intelligence, or threat hunting.
• 4+ years of Fortinet FortiSOAR experience.
• Experience developing FortiSOAR connectors and playbooks.
• Experience integrating various technologies with a SOAR platform.
• NSE 6 FortiSOAR Administrator or NSE 7 FortiSOAR Design and Development (Architect) certification.
• Experience designing, implementing, maintaining, and optimizing playbooks for detection, protection, containment, and mitigation of cybersecurity threats and incidents.
• Strong scripting and integration skills in Python, Go, Kusto/KQL, and PowerShell.
• Expert knowledge of information-security technologies, including SIEM, NGFW, CTI, and WAF, as well as IT systems such as Office 365, service-management tools, and integration, automation, and orchestration interfaces.

Preferred

• Exposure to SIEM systems, including Splunk, Sentinel, QRadar, and Securonix.