Security Automation Engineer (Autonomous Workflow)

Application Deadline:08/16/2026Address:100 King Street WestJob Family Group:TechnologyJob posting:We are building a modern, automation-first Security Operations capability focused on real-time detection and response to cyber threats where the majority of alerts are automatically enriched, triaged, or resolved with minimal analyst intervention.This role goes beyond traditional automation engineering. You will design and build autonomous workflows that combine detection logic, automation, and AI-assisted development into scalable, repeatable systems.Our team was tasked to reduce the investigation time and empower SOC analysts with qualitative and enriched alerts, giving them back the time they need to hunt real threats. Our current philisophy is to prioritize practical delivery over perfect initial solution—leveraging SOAR, Power-automate and GitHub Copilot to collaborate, experiment, and ship high-impact solutions quickly.What You’ll DoBuild Autonomous Security WorkflowsDesign, produce and manage end-to-end automation that enhance detection via enrichment, triage, response, containment or auto closure.Navigate across multiple security platforms (ServiceNow, Splunk ES, CrowdStrike) to improve signal to noise ratio and reduce mean time to respond and contain.AI-Driven Workflow DevelopmentDesign LLM-generated & enriched workflows combined with deterministic logic for reliability across multiple stacks (Splunk SOAR playbooks, Python scripts, Power Automate)Build multi-step, agent-like flows that enrich alerts, validate data, and support automated triage decisionsApply detection-as-code principles such as version-controlled workflows, CI/CD pipelines, testing, validation, and peer review.Collaboratively build resilient and audit ready solutionsPartner with detection engineers and SOC analysts to operationalize detections with automation workflows and improve triage speed and response consistencyUse GitHub Copilot daily to accelerate development and prototypingApply strong judgment on when to use LLM-based vs traditional code and how to ensure outputs are reliable, auditable, and repeatableCollaborate primarily through GitHub (repos, PRs, code reviews) as the single source of truth, as well as shared libraries, reusable workflow patterns, agent/workflow templates.Solve Complex Integration ProblemsReverse-engineer APIs and integrations when documentation is limitedHandle real-world challenges related to Authentication (OAuth, tokens), pagination, retries, rate limits, data normalization and enrichmentSupport building and maintaining an automation library and a stable automation platform.Design workflows resilient to API failures, partial data, third-party instabilityMust-HaveTypically a post-secondary degree in Computer Science, Engineering, Information Systems, Information Security and between 2-4 years of relevant experience in either Security automation OR AI powered program development OR Detection engineering environmentsProven ability to build and ship automation end-to-endExperience integrating systems via APIs (REST/JSON, auth patterns)Hands-on GitHub experience (PRs, branching, collaboration)Daily use (or strong experience) with GitHub Copilot or similar AI coding toolsAbility to work in ambiguous, evolving environments and still deliver solutionsHighly Valuable (What Sets You Apart)Experience designing AI-driven workflows or agent-style systemsUnderstanding of Prompt design coupled with structured output as well as orchestration patterns (multi-step, validation loops, fallback, retry)Ability to combine AI capabilities with deterministic logic (Python, rules, validation layers)Strong intuition to distinguish when AI adds value vs when it adds risk or costHow You WorkBuilder mindset: you prototype, ship, and iterate quicklyPragmatic security engineer: you choose the simplest solution that works while considering risksData driven: you seek continuous improvement based on metrics observation (success rate, failures pattern)Curious and experimental: you actively explore new tools and approachesOwnership-driven: you take initiative to unblock yourself, you self identify automation opportunities with high impact on detection coverage, analyst time to resolve and respond.Why This RoleBuild the next generation of security workflowsShape how AI is practically used in a SOC environmentWork in a team that values:Speed with risk-aware executionOwnershipReal impact via simplified processesSalary:$82,800.00 - $154,800.00Pay Type: SalariedThe above represents BMO Financial Group’s pay range and type.Salaries will vary based on factors such as location, skills, experience, education, and qualifications for the role, and may include a commission structure. Salaries for part-time roles will be pro-rated based on number of hours regularly worked. For commission roles, the salary listed above represents BMO Financial Group’s expected target for the first year in this position.BMO Financial Group’s total compensation package will vary based on the pay type of the position and may include performance-based incentives, discretionary bonuses, as well as other perks and rewards. BMO also offers health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. To view more details of our benefits, please visit: About UsAt BMO we are driven by a shared Purpose: Boldly Grow the Good in business and life. It calls on us to create lasting, positive change for our customers, our communities and our people. By working together, innovating and pushing boundaries, we transform lives and businesses, and power economic growth around the world.As a member of the BMO team you are valued, respected and heard, and you have more ways to grow and make an impact. We strive to help you make an impact from day one – for yourself and our customers. We’ll support you with the tools and resources you need to reach new milestones, as you help our customers reach theirs. From in-depth training and coaching, to manager support and network-building opportunities, we’ll help you gain valuable experience, and broaden your skillset.To find out more visit us at .BMO is committed to an inclusive, equitable and accessible workplace. By learning from each other’s differences, we gain strength through our people and our perspectives. Accommodations are available on request for candidates taking part in all aspects of the selection process. To request accommodation, please contact your recruiter.Note to Recruiters: BMO does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to BMO, directly or indirectly, will be considered BMO property. BMO will not pay a fee for any placement resulting from the receipt of an unsolicited resume. A recruiting agency must first have a valid, written and fully executed agency agreement contract for service to submit resumes.SummaryLocation: Toronto, ON, CANType: Full time