Fortisoar Admin

Role & responsibilities

Strong hands-on expertise in FortiSOAR administration, architecture, configuration, HA, playbook development, security orchestration and automation, connector configuration, custom connector development, REST API integrations, third-party security integrations, incident/case management, threat intelligence and IOC enrichment, automated investigation and response, dashboards and reporting, troubleshooting, performance monitoring, backup/restore, upgrades and Python/scripting for automation.

Preferred candidate profile

1. FortiSOAR Administration

The engineer should be able to independently manage and maintain the FortiSOAR platform, including:

• Day-to-day FortiSOAR administration and health monitoring.
• User, role and access management.
• Configuration and maintenance of FortiSOAR servers/nodes.
• Monitoring system performance, services, jobs and playbook executions.
• Incident, alert, case and task management.
• Troubleshooting FortiSOAR platform issues.
• Backup and restoration activities.
• Configuration management and change management.
• Support FortiSOAR HA operations and failover troubleshooting.
• Support database-related operational issues and coordination with database administrators.

This is particularly important because the proposed architecture includes Active-Passive HA and separate FortiSOAR deployment capabilities for an air-gapped environment.

1. Playbook Development & Automation

This should be one of the core responsibilities of the engineer.

The engineer must be capable of:

• Designing and developing FortiSOAR playbooks.
• Modifying and optimizing existing playbooks.
• Creating automation workflows based on SOC requirements.
• Developing conditional logic, approvals and decision workflows.
• Creating automated enrichment and remediation workflows.
• Handling error conditions and exceptions within playbooks.
• Troubleshooting failed playbook executions.
• Developing reusable automation components.
• Creating notifications and escalation workflows.
• Maintaining documentation for developed playbooks.

The engineer should be able to translate a SOC analyst's manual process into an automated FortiSOAR workflow.

1. Security Integrations / Connectors

The engineer should have strong practical experience integrating FortiSOAR with third-party security platforms using APIs and connectors from the FortiSOAR side.

At minimum, the resource should be comfortable working with:

• FortiGate
• Sandbox
• Microsoft Exchange / Email
• Active Directory
• Threat Intelligence Platforms
• VirusTotal
• FortiGuard Threat Intelligence
• SIEM platforms (FortiSIEM and Logrhythm)
• EDR/XDR platforms
• Vulnerability Management platforms
• Network/security infrastructure