Lead Response Technology and Automation Security Engineer

Mastercard is hiring a Lead Response Technology and Automation Security Engineer in Pune, India. Level rates it ; you can apply on Mastercard.

Level's read on this job

Works on AI ●●●○ is how Level rates this cybersecurity role: the daily work is on AI products, without building the model.
The posting mentions Soar, SIEM and Edr among its tools and skills.
Level classes it as a lead role.
Mastercard has 1,000+ other open roles on Level.

AI in this role

Design and operationalize AI-augmented response workflows, agentic AI integration, and SOAR playbooks for security operations.

soarsiemedrjupyter

llm-integrationsecurity-operationsincident-responseautomationagentic-aiprompt-engineering

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary

Lead Response Technology and Automation Security Engineer

Overview

The Corporate Security Threat and Response Management product ownership team is looking for a Lead Level Security Engineer to help drive our Security Operations modernization strategy. The ideal candidate is passionate about the modern security tools, capabilities, and strategies.

The RESPOND product team executes on the multi-year strategy and roadmap set by the RESPOND product owner to evolve and modernize SecOps incident investigation and response technology, capabilities, tools, and process.
Response product team members work closely with regional SOC teams to execute the RESPOND product strategy on the ground. This role is the connective tissue between product vision and operational reality: building, tuning, and operationalizing response automation, AI-augmented workflows, and analyst tooling that SOC and DFIR teams rely on every day. The RESPOND product team is hands-on with SOAR development, agentic AI integration, notebook-based investigation tooling, and continuous improvement of analyst workflows.

Core Responsibilities
• Execute the RESPOND product roadmap in close partnership with SOC and Incident Response teams in the region.
• Design, build, test, and maintain SOAR playbooks used for incident triage and response scopes to collect and process digital evidence and artifacts at speed and scale.
• Build and operationalize AI-augmented response capabilities, including:
o Agentic AI workflows integrated into triage, enrichment, and response.
o Prompt books and prompt libraries tuned for SOC and Incident Response use cases.
o Prompt-book/code notebook (Jupyter, etc) development for repeatable investigation, hunt, and DFIR workflows.
o LLM-driven enrichment and summarization integrated into case management.
• Define strategic requirements and oversee management for connectors, apps, and integrations between SOAR, SIEM, EDR, identity, ticketing, threat intelligence, and AI/LLM platforms (including MCP servers where applicable) for build through our dedicated engineering partners.
• Build and maintain response tooling: scripts, live-response packages, enrichment services, and automation utilities deployable via EDR and SOAR.
• Embed with SOC and DFIR analysts to identify high-toil workflows and convert them into automated, AI-assisted, or fully autonomous playbooks with appropriate guardrails.
• Tune and optimize playbooks and AI-assisted workflows against measurable outcomes (MTTR, false-positive rate, analyst touch time, AI-assist accuracy).
• Contribute to the centralized response tooling, prompt book, and notebook libraries, ensuring code quality, documentation, version control, and reusability across regions.
• Support major incident response activities by deploying and operating response tooling and AI-assisted investigation workflows under pressure.
• Provide feedback into the product backlog and partner with the PO on requirements refinement.
• Document playbooks, prompt books, notebooks, and technical designs to enterprise standards.

All About you
• 5+ years in security operations, incident response, detection engineering, or security automation engineering
• Prior experience as a SOC analyst, Security Engineer, Digital Forensics Examiner, SOAR engineer, and/or threat hunter preferred.
• Hands-on SOAR development experience with low-code/no-code or hyper-automation tools and concepts. Must be able to define and build reliable, scalable response capabilities.
• Demonstrated enterprise experience executing on AI-augmented SOC concepts, including at least two of:
o Building and maintaining AI prompt books for analyst workflows.
o Developing Jupyter notebooks for investigation, hunt, or DFIR.
o Integrating LLMs or agentic AI into XDR, SOAR, case management, or response tooling.
o Leveraging IDEs with AI connectors to process data and execute AI workflows
o Deploying agent-based AI workflows for triage or enrichment in production.
• Strong scripting skills in Python and PowerShell. Comfortable with basic code repo management using Git or equivalent.
• Working knowledge of REST APIs, JSON, webhooks, and authentication patterns (OAuth, API keys, managed identities).
• Solid grounding in incident response fundamentals and the IR lifecycle.
• Hands-on experience with: EDR platforms (CrowdStrike, SentinelOne, Defender for Endpoint), SIEM (Splunk ES, Microsoft Sentinel), identity platforms (Entra ID, Okta), cloud platforms (AWS, Azure, GCP), and cloud protection products (CNAPP, CWPP, CSPM).
• Familiarity with MITRE ATT&CK and the ability to map response actions to adversary techniques.
• Demonstrated ability to operate inside an agile delivery model with a product backlog.
Preferred Qualifications
• Bachelor’s degree in computer science, cybersecurity, or IT-focused disciplines (or equivalent experience).
• At least two Industry certifications: GCFA, GCIH, GNFA, GCFR, GREM, or equivalent.
• Experience with SecOps focused MCP server architectures, agentic frameworks, or tools
• Experience building EDR live-response scripts and tool libraries.
• Exposure to detection-as-code and response-as-code practices, including CI/CD for security content.
• Background in regulated financial services or Fortune 500 SOC environments.

Corporate Security Responsibility

All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

Abide by Mastercard’s security policies and practices;
Ensure the confidentiality and integrity of the information being accessed;
Report any suspected information security violation or breach, and
Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.

How we rate this

Lead Response Technology and Automation Security Engineer at Mastercard rates 65 out of 100 for how much of the daily work is AI. That makes it Works on AI (AI Level 3 of 4). The level is about AI in the job, not seniority.

Classification

Works on AI. The daily work is on AI products, without building the model.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Read the description and count the AI tools, models and workflows it names.

Key facts

Lead Response Technology and Automation Security Engineer is an open job at Mastercard.
Level rates this role AI Level 3 of 4: Works on AI.
The role is based in Pune, India.
The job was posted on September 1, 2026.
Seniority: lead.
Applications are handled by Mastercard. Apply on Mastercard

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

LLM IntegrationSecurity OperationsIncident ResponseAutomationAgentic AIPrompt engineeringSoarSIEM

Also common in cybersecurity jobs at this level

AI agents Kubernetes Generative AI Java Terraform C++

Pay

Typical cybersecurity job: $159k

This posting doesn't list pay. Use the typical cybersecurity figure when pay comes up. See cybersecurity jobs

Questions you could be asked

How have you integrated a large language model into a production application?
Tell me about a project where security operations was part of your work. What did you do?
Tell me about a project where incident response was part of your work. What did you do?
Tell me about a project where automation was part of your work. What did you do?
Tell me about a project where agentic ai was part of your work. What did you do?

Adapt your resume

List these exact terms on your resume: LLM Integration, Security Operations, Incident Response, Automation, and Agentic AI. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.
Show where AI is part of your daily process, not a one-off project. This role expects it to be a running habit.

Want an expert to read your CV for this job?

Free. Send your CV and the role you want next. You get your review by email within 24 hours.

Get a free CV review Get your CV rewritten Check your resume with the ATS resume checker

Get new cybersecurity jobs (Works on AI ●●●○ or higher) by email

One email a week with the new cybersecurity jobs (Works on AI ●●●○ or higher), each rated for how much AI is in the work. No recruiter spam, unsubscribe in one click.

Free. One email a week. Unsubscribe in one click.