SOAR Playbook Engineer — MXDR Automation Specialist

NCC Group; Comunidad de Madrid; On-site; EUR 60,000 - 80,000; Full time

Benefits offered by this job

Flexible Working

Generous Holiday Allowance

Medicash & Critical Illness Scheme

Pension, Life Assurance, and ShareSave

Community & Volunteering Programmes

Green Car Scheme

Cycle Scheme

Special Time Off

Family Planning

Job summary

NCC Group is seeking a SOAR Playbook Engineer in Madrid to design, develop, and optimise security automation using Splunk SOAR. You will focus on playbook engineering, Python development, API integrations, and automated incident response workflows.

You will deploy and maintain MXDR solutions, assess customer requirements, and collaborate with stakeholders to keep environments secure and operationally effective. Strong English communication is required in this global team.

Qualifications

• Hands-on Splunk SOAR engineering experience.
• Advanced Python development skills including REST APIs, JSON processing, testing and debugging.
• Experience developing and maintaining production Splunk SOAR playbooks.
• Experience with SIEM tools such as Splunk Enterprise Security and notable event workflows.
• Experience using Git and software development best practices.
• Strong understanding of SOC operations and incident response.
• Excellent customer-facing communication and consultancy skills.
• Knowledge of Microsoft Defender, CrowdStrike and SentinelOne integrations is desirable.

Responsibilities

• Design, develop, test and maintain Splunk SOAR playbooks.
• Develop custom Python automations and API integrations.
• Build enrichment, investigation, containment and remediation workflows.
• Troubleshoot playbook, connector and integration issues.
• Integrate Splunk SOAR with security, cloud and ITSM platforms.
• Improve automation coverage, reduce analyst effort and lower MTTR.
• Maintain documentation, code repositories and engineering standards.
• Act as the Splunk SOAR SME for customers and internal teams.

Skills

Splunk SOAR

Python

REST APIs

JSON processing

Testing & debugging

SIEM (Splunk ES)

Git

SOC operations

Customer-facing

Security integrations

Job description

NCC Group is seeking a SOAR Playbook Engineer in Madrid to design, develop, and optimise security automation using Splunk SOAR. You will focus on playbook engineering, Python development, API integrations, and automated incident response workflows.

You will deploy and maintain MXDR solutions, assess customer requirements, and collaborate with stakeholders to keep environments secure and operationally effective. Strong English communication is required in this global team.