AVP, Security Automation Developer (L10)

Job Description:

 Role Title: 2602153 AVP, Security Automation Developer (L10)

Company Overview: Synchrony (NYSE: SYF) is a leading consumer financing company that has been at the heart of American commerce and opportunity for nearly a century. Synchrony delivers credit and banking products that empower tens of millions of consumers to improve their financial lives and access what matters most. Leveraging innovative solutions that are shaping the future of retail commerce, Synchrony supports the growth and success of some of the nation’s most respected brands, alongside hundreds of thousands of small and midsize businesses, including health and wellness providers. Committed to excellence in service and culture, Synchrony is proud to be named as #3 as a Great Place to Work® in India and is honored to be ranked the #1 Best Company to Work For® in the U.S. by Fortune magazine and Great Place to Work®. For more information, visit www.synchrony.com.

Organizational Overview: The Cyber Operations organization is responsible for protecting Synchrony’s technology environment through continuous monitoring, rapid response to security events, and operational execution of key cybersecurity controls. Cyber Operations partners closely with Technology teams, Security Architecture/Engineering, Governance Risk & Compliance (GRC), and business stakeholders to reduce risk, maintain resilience, and support secure business outcomes.

Role Summary/Purpose:

The AVP, Security Automation Developer will build and maintain automation that improves the reliability, accuracy, and operational health of threat detection content and alerting ecosystem. This role is responsible for designing and maintaining automated notifications and alert workflows, supporting the underlying scheduled searches and shared components (e.g., macros, lookups, permissions) that detection content depends on, and implementing ongoing measurement/validation processes to ensure detection content meets defined quality standards. The developer will create and maintain dashboards and metrics to continuously monitor detection posture in real time, quickly identify failures or degradation (e.g., missed alerts, stale data, false positives), and drive corrective improvements.

Key Responsibilities:

• Splunk Mission Control: Develop and manage Splunk Mission Control to enhance incident response capabilities and streamline security operations.
• Design and implement automated validation for critical security logs (e.g., ingestion, completeness, parsing/normalization, schema consistency, field-level accuracy, timeliness/latency).
• Build automated tests and guardrails for detection logic (unit-style tests for rules, regression testing, false positive/false negative analysis support, rule performance/quality checks).
• Create and maintain dashboards for operational monitoring and executive-ready metrics (e.g., data quality KPIs, detection coverage trends, validation pass/fail rates, alert fidelity).
• Integrate validation and monitoring into engineering workflows using CI/CD and version control best practices (test automation, pull request checks, release gating where appropriate).
• Partner with JSOC, Threat Informed Defense, and additional Cyber Operations teams to define standards for “good telemetry” and measurable detection reliability.
• Build and maintain integrations with security data platforms and tools via APIs and automation frameworks.
• Produce clear documentation, runbooks, and operational procedures; ensure solutions are auditable and maintainable.

Required Skills/Knowledge:

• Bachelor’s degree with 4+ years of experience with Information Security along with Splunk ES and in lieu of degree with 6+ years of experience required.
• 4 years of Splunk Search Processing Language (SPL): Proficiently utilize Splunk SPL for querying, analyzing, and visualizing data to inform timely security decisions.
• Assets & Identities: Construct and manage comprehensive Splunk ES assets and identities, ensuring accurate security posture and entity correlation.
• Alert Actions: Develop, manage, and leverage Splunk ES alert actions to automate and optimize threat detection and response processes.
• Programming Expertise: Utilize Python and HTTP client programming to integrate and automate security solutions efficiently.
• Ability to translate ambiguous problems into measurable requirements and deliver reliable solutions.

Desired Skills/Knowledge:

• Previous experience in working with or in SOC and Incident Response programs
• Experienced working in organizations that leverage agile methodologies.
• Experience working in cloud environments (AWS/Azure).

Eligibility Criteria:

Bachelor's Degree in any discipline with minimum 6+ years of overall experience or in lieu of a degree, 8+ years of

overall experience.

Work Timing: 2:00 PM to 11:00 PM IST

(WORK TIMINGS: This role qualifies for Enhanced Flexibility and Choice offered in Synchrony India and will require the incumbent to be available between 06:00 AM Eastern Time – 11:30 AM Eastern Time (timings are anchored to US Eastern hours and will adjust twice a year locally). This window is for meetings with India and US teams. The remaining hours will be flexible for the employee to choose. Exceptions may apply periodically due to business needs. Please discuss this with the hiring manager for more details.)

For Internal Applicants:

• Understand the criteria or mandatory skills required for the role, before applying

• Inform your manager and HRM before applying for any role on Workday

• Ensure that your professional profile is updated (fields such as education, prior experience, other skills) and it is

mandatory to upload your updated resume (Word or PDF format)

• Must not be on any corrective action plan (First Formal/Final Formal, LPP)

• L8+ Employees who have completed 18 months in the organization and 12 months in current role and level are only eligible.

• L8+ Level Employees can apply

Grade/Level: 10

Job Family Group:

Information Technology