Lead Security Automation Consultant

What You Will Do & The Experience You Will Need

Trility Consulting is seeking an experienced Lead Security Automation Consultant to support a short-term client engagement focused on building and implementing security automation workflows and integrations.

In this hands-on role, you'll work across several defined use cases, developing automated security workflows that connect platforms such as Tines, Microsoft Azure, ServiceNow, and other security tools. You'll leverage Python, Azure Functions, Microsoft Graph, Microsoft Entra ID, KQL, and API integrations to automate security triage, case handling, and notifications while improving how information moves between systems.

We're looking for a senior-level engineer who can hit the ground running, work independently, and translate defined requirements into reliable, reusable automation solutions. Experience with Tines is welcome, but hands-on experience with comparable security orchestration or workflow automation platforms is also relevant.

This project will be approximately six weeks, starting mid-December 2026 and running through late January 2027. This is a remote 1099 contract position.

• Design, develop, and implement security automation workflows across several defined client use cases
• Build integrations between security platforms, ServiceNow, and other enterprise applications using REST APIs and Microsoft Graph
• Develop and maintain Python-based Azure Functions to support automation and integration requirements
• Build and work with KQL queries, particularly Microsoft Defender advanced hunting, to retrieve, filter, and analyze security data
• Develop automated workflows using Tines or comparable security orchestration and automation platforms
• Integrate security alerts, incident data, and case-handling processes with ServiceNow
• Work with Microsoft Entra ID to support identity-related automation, including group membership changes and application registration credentials
• Implement Azure DevOps pipelines to deploy Azure Functions and support controlled release processes
• Work within the client's change-control and approval processes to ensure changes are properly reviewed, tested, and deployed
• Troubleshoot, test, and optimize automation workflows and integrations to ensure reliability
• Build reusable components that other engineers can extend, develop supporting runbooks, and lead knowledge-transfer sessions with the client's engineer
• Collaborate with client stakeholders to understand requirements and translate them into practical automation solutions

• 5+ years of experience in security engineering, security automation, systems integration, or a related technical discipline
• Hands-on experience designing and implementing security automation or workflow automation solutions
• Strong Python development experience, including building and deploying Azure Functions
• Experience writing and working with Kusto Query Language (KQL), particularly Microsoft Defender advanced hunting
• Experience integrating ServiceNow with security platforms or other enterprise applications
• Strong experience building and consuming REST APIs and developing application integrations
• Experience with Microsoft Graph and Microsoft Entra ID, including automating group membership changes and working with application registration credentials
• Experience implementing Azure DevOps pipelines to deploy Azure Functions
• Experience working within structured change-control and approval processes
• Experience with a security orchestration or workflow automation platform such as Tines, Torq, Swimlane, Splunk SOAR, Cortex XSOAR, or Microsoft Sentinel Playbooks/Azure Logic Apps
• Ability to independently develop, troubleshoot, and deliver working automation solutions within a defined project timeline
• Strong problem-solving, communication, documentation, and knowledge-sharing skills

• Direct, hands-on experience with Tines
• Experience with Microsoft Sentinel and Sentinel playbooks
• Experience with Defender for Office 365 or Proofpoint email and click data
• Experience working with Tenable and Common Vulnerabilities and Exposures (CVE) data
• Experience integrating or working with Hunters security platform
• Familiarity with n8n, Power Automate, Workato, or other workflow automation platforms
• Experience building security triage, ticketing, and case-management workflows
• Experience working in a consulting or professional services environment