Project Description

Employer case study · Palo Alto Networks

SOAR playbooks that run themselves

As a Senior Customer Success Engineer on Cortex XSOAR at Palo Alto Networks, I carried a $7M ARR portfolio of enterprise security customers — SOCs whose alert volume no human team could keep up with by hand.

The problem

Enterprise incident response was manual at every step: an alert fires, an analyst enriches it across half a dozen consoles, opens a ticket, notifies the right people, and starts the response — twenty minutes of copy-paste per incident, thousands of incidents a month. The tooling existed; the system didn’t.

What I built

SOAR playbooks — drawn as workflows, hardened with custom Python, and wired into the customer’s actual stack — so that triage, enrichment, ticketing, and first response happen before an analyst touches the incident.

Playbook architecture

Incident-response workflows designed with the customer, then deployed into their live SOC — the blueprint step, in production.

Custom Python

Where the out-of-the-box blocks stopped, custom Python automations carried the playbook the rest of the way.

Ecosystem integrations

CrowdStrike, ServiceNow, Splunk, and Jira wired into one flow — the response moves across tools without a human ferrying it.
$7M
ARR portfolio supported
4+
enterprise integrations
SOC
grade — live production
Python
custom automation

This is where the standards this business builds to were forged: if a workflow can be trusted inside a Fortune-scale security operations center, it can be trusted running your business.

The same discipline runs this business today.

Angel Menendez

Written by

Angel Menendez

Founder & Principal AI Systems Architect