Cybersecurity Automation Engineer III

Our team members are the key to our company’s success, and their health and well-being, as well as that of their families, is very important to us. We offer a comprehensive benefits package that allows our team members stay healthy, plan for their future and maintain a healthy work-life balance. Benefits may vary with employment status.  To see our fill list of Team Member Benefits please visit our career site: www.gotoworkhappy.com/benefits

Job Description:

At Seminole Hard Rock Support Services, we're on a mission to protect our guests, team members, and enterprise assets through world-class cybersecurity practices. As the Cybersecurity Automation Engineer, you will design, build, and continuously evolve the security automation and orchestration capabilities that underpin our enterprise cyber defense strategy, enabling faster threat response, streamlined identity operations, and intelligent, repeatable security workflows at scale.

Reporting to the Manager of IAM & Automation, this role requires a highly technical, full-stack engineer and forward-thinking architect who can translate cybersecurity strategy into production-grade automation solutions. You will personally design and develop applications, integrations, and AI-driven tooling across the full technology stack, from front-end interfaces and APIs to back-end services, infrastructure, and cloud platforms, integrating capabilities across IAM, security operations, and compliance to reduce manual effort, accelerate incident response, and strengthen the overall security posture across all Seminole Hard Rock business units.

This is a hands-on engineering role. The ideal candidate writes and ships production code, architects scalable systems, owns their solutions end-to-end, and brings the discipline of a software engineer to the problems of enterprise cybersecurity.

Architecture & Design

• Design and maintain the enterprise security automation architecture, ensuring alignment with the broader cybersecurity strategy, zero-trust principles, and business objectives
• Evaluate, select, and integrate security automation platforms and tooling into a cohesive, scalable ecosystem, spanning hyperautomation/SOAR, SIEM and security analytics, telemetry pipelines, and cross-platform integrations with the broader security tool portfolio
• Define automation design patterns, standards, and reusable frameworks that accelerate development and ensure consistency across security domains
• Design infrastructure architectures across Linux and Windows environments, leveraging IaaS and PaaS services to deliver resilient, scalable, and cost-effective automation platforms
• Maintain architecture documentation, integration maps, and decision records so the automation ecosystem is fully understood and transferable

Full-Stack Development & Engineering

• Develop production-quality security automation applications, tools, and integrations across the full stack, including front-end dashboards and portals, RESTful/GraphQL APIs, back-end services, and database layers
• Build and deploy AI and machine learning-powered solutions using Python (or similar) to automate threat detection, anomaly identification, intelligent access decisions, and predictive security analytics
• Develop and optimize integrations between security tools, cloud platforms (Azure, AWS), ITSM systems, and IAM platforms using Python, PowerShell, REST APIs, and modern integration frameworks
• Design and manage infrastructure-as-code (Terraform, Ansible, Salt/SaltStack, ARM/Bicep) for automated deployment and configuration of security platforms across IaaS and PaaS environments
• Implement CI/CD pipelines for security automation codebases, ensuring rigorous testing, version control, and reliable deployments across development, staging, and production environments
• Apply software engineering best practices to all automation work: peer code review, unit and integration testing, branching strategies, release tagging, and inline documentation

Security Orchestration & Workflow Automation

• Design, develop, and maintain automated security workflows and orchestration playbooks for incident response, alert triage, threat enrichment, and remediation, moving beyond off-the-shelf playbooks to custom-engineered solutions
• Build event-driven automation that responds in real time to signals from SIEM, EDR, IAM, and cloud platforms, reducing mean time to detect and respond across the security operations function
• Automate identity lifecycle workflows (joiner/mover/leaver) in close collaboration with the IAM team, including provisioning, de-provisioning, access reviews, and certification campaigns
• Develop self-service automation portals and tooling that enable cybersecurity team members to trigger, monitor, and audit automated workflows without engineering intervention

Infrastructure & Platform Engineering

• Architect and manage automation platform infrastructure spanning Linux and Windows server environments, containerized workloads (Docker, Kubernetes), and cloud-native services
• Leverage IaaS capabilities (virtual machines, networking, storage) and PaaS services (serverless functions, managed databases, messaging queues, app services) to build and scale security automation solutions
• Ensure automation platforms and custom-developed applications meet enterprise standards for performance, high availability, disaster recovery, and security hardening
• Collaborate with infrastructure, cloud engineering, and DevOps teams to optimize the underlying compute, network, and storage layers supporting security automation workloads

Continuous Improvement & Innovation

• Establish metrics and KPIs to measure automation effectiveness, coverage, and ROI, continuously identifying opportunities to expand and refine capabilities
• Research, prototype, and integrate AI/ML models and emerging technologies (large language models, generative AI, intelligent agents) into security automation workflows to drive next-generation cyber defense capabilities
• Stay at the forefront of security automation, AI-driven security analytics, full-stack development practices, and emerging orchestration technologies, piloting and adopting innovations that deliver measurable advantage
• Serve as a subject matter expert and technical advisor on security automation and development best practices, mentoring junior engineers and contributing to a culture of continuous learning and improvement

• 6–8+ years of experience in cybersecurity engineering, security automation, software development, or security architecture, ideally within gaming, hospitality, or large-scale consumer enterprises
• Demonstrated success designing and implementing enterprise-scale security automation and orchestration solutions: SOAR, automated playbooks, custom-developed security tooling, and integration pipelines
• Full-stack development proficiency, hands-on experience building and deploying applications across front-end (React, Angular, Vue.js, or similar), back-end (Python, Node.js, Go, or similar), API layers (REST, GraphQL), and database technologies (SQL, NoSQL)
• Strong Python expertise (or equivalent language) with demonstrated experience building AI/ML-powered solutions, automation scripts, data pipelines, and integration services
• Hands-on experience with the enterprise security automation stack, including hyperautomation/SOAR, SIEM and security analytics, and telemetry pipeline platforms, and integrations across endpoint, network, identity, cloud, and email security tooling
• Infrastructure fluency across Linux and Windows server environments, with hands-on experience designing and managing workloads in IaaS (virtual machines, networking, storage) and PaaS (serverless, app services, managed databases, containers) on Azure and/or AWS
• Strong technical fluency in IAM technologies: identity governance and administration (IGA), enterprise directory and federation (Microsoft Entra ID), privileged access management, non-human identity governance, and secrets management
• Deep understanding of zero-trust architecture, identity governance, privileged access management, and cloud security principles
• Experience with infrastructure-as-code (Terraform, Ansible, Salt/SaltStack, ARM/Bicep), containerization (Docker, Kubernetes), and CI/CD pipelines
• Relevant certifications preferred: CISSP, CISM, CISA, Microsoft SC-series, Azure Developer/Architect, AWS Developer/Solutions Architect, vendor certifications in identity governance and endpoint security platforms, or equivalent

• Translate complex cybersecurity and automation requirements into clear architectural designs, technical specifications, and production-ready code
• Operate as a hands-on engineer who architects solutions and personally writes, reviews, and ships high-quality code, not a delegator
• Collaborate effectively across cross-functional teams, bridging security, software development, infrastructure, IT operations, and business stakeholders to deliver integrated automation solutions
• Thrive in an Agile, fast-paced environment that values experimentation, rapid iteration, and measurable results
• Communicate complex technical concepts clearly to both technical and non-technical audiences, including architecture reviews, leadership briefings, and written documentation
• Demonstrate a passion for eliminating manual toil through intelligent automation and modern software engineering, continuously seeking ways to make security operations faster, smarter, and more resilient
• Hold themselves and their code to high standards: thorough testing, peer review, documentation, and ownership through production