SOAR Engineer

CyberGate Defense; Abu Dhabi; On-site; AED 120,000 - 160,000; Full time

Job summary

CyberGate Defense is looking for a seasoned professional to drive SOAR playbook design and implementation in Abu Dhabi. The ideal candidate will possess over 5 years of SOAR experience, particularly with FortiSOAR, and exhibit strong Python scripting and API integration skills.

This role focuses on enhancing SOC automation, integrating security tools, and collaborating with teams to improve incident response efficiency. The position is essential in optimizing performance in high-volume SOC environments.

Qualifications

• 5+ years of SOAR experience (design, development, deployment).
• 1+ year hands-on experience with FortiSOAR.
• Strong Python scripting and API integration skills.

Responsibilities

• Design and implement advanced SOAR playbooks.
• Integrate SOAR platforms with security tools.
• Lead playbook validation and deployment.

Skills

SOAR experience

Python scripting

API integration

SOC operations knowledge

Stakeholder communication

Tools

FortiSOAR

IBM SOAR (Resilient)

AWS

Azure

GCP

Job description

Responsibilities

• Design and implement advanced SOAR playbooks for use cases such as phishing, incident response, vulnerability management, and threat hunting.
• Integrate SOAR platforms with SIEM, EDR/NDR, TIPs, and ITSM tools.
• Develop custom scripts, APIs, and integrations to extend automation capabilities.
• Lead playbook validation, testing, and production deployment.
• Optimize SOAR performance in high-volume SOC environments.
• Collaborate with SOC teams to enhance automation maturity and response efficiency.
• Create dashboards, reports, and documentation, and drive knowledge transfer.
• Continuously improve automation based on emerging threats and TTPs.

Qualifications

• 5+ years of SOAR experience (design, development, deployment).
• Minimum 1+ year hands‑on experience with FortiSOAR.
• Experience with IBM SOAR (Resilient) is a strong advantage.
• Strong Python scripting and API integration (REST/SOAP, JSON, XML).
• Solid understanding of SOC operations, incident response, and SIEM platforms.
• Experience integrating security tools (firewall, EDR, IDS/IPS, DLP, email security).
• Exposure to cloud platforms (AWS/Azure/GCP) and security frameworks (NIST, ISO 27001, etc.).
• Strong stakeholder communication and project delivery skills.

Impact

Drive end-to-end SOC automation, reduce manual effort, and improve incident response speed, consistency, and scalability.