SOAR Engineer

Sanderson Government and Defence; Cheltenham; On-site; GBP 90,000 - 110,000; Full time

Job summary

Sanderson Government and Defence is seeking a highly experienced security professional for an 18-month fixed-term contract to safeguard OT and CNI environments. Role emphasizes designing SOAR playbooks, tuning Splunk searches, and incident detection in high-consequence settings.

The candidate will collaborate with engineering and safety teams, ensuring security monitoring matures across converged industrial and enterprise networks.

Qualifications

• Active SC clearance is required.
• Proven experience in CNI or OT environments.
• Hands-on experience with SOAR platforms and Splunk.
• Solid grasp of differences between OT and IT security.

Responsibilities

• Designing, building, and maintaining SOAR playbooks to automate detection and response workflows.
• Developing and tuning Splunk use cases, dashboards, and correlation searches across IT and OT data sources.
• Supporting incident detection and response within CNI/OT environments, working with engineering and safety teams.
• Contributing to the maturity of security monitoring across converged industrial and enterprise networks.
• Working with OT constraints like availability, safety, and legacy systems.

Skills

SOAR platforms

Splunk

Active SC clearance

OT vs IT security

Live high-consequence environment

Tools

Splunk

Job description

Salary: £100,000 - 100,000 per year

Requirements

• Active SC clearance
• Proven experience working within CNI or OT environments
• Strong hands-on experience with SOAR platforms and Splunk
• A solid grasp of the differences between securing OT and IT
• Comfortable operating in a live, high-consequence environment where good judgement matters as much as technical skill

Responsibilities

• Designing, building, and maintaining SOAR playbooks to automate detection and response workflows
• Developing and tuning Splunk use cases, dashboards, and correlation searches across IT and OT data sources
• Supporting incident detection and response within CNI/OT environments, working closely with engineering and safety teams
• Contributing to the maturity of security monitoring across converged industrial and enterprise networks
• Working within a team that understands the unique constraints of OT, including availability, safety, and legacy systems, versus traditional IT security

Technologies

• Support
• Security
• Splunk

More

We are a leading cyber security firm supporting a critical national infrastructure client on an 18-month fixed-term contract. This is a high-visibility role within our security operations function, focused on protecting operational technology environments that underpin essential national services. We offer the potential for extension or conversion to a permanent role, subject to programme trajectory. We value respect, equality, and inclusion, and we welcome applications from people of all backgrounds and perspectives.