SOAR Engineer

National Gas Transmission PLC; Warwick; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Pension

Annual bonus

Healthcare

Life assurance

Professional development

Job summary

National Gas Transmission PLC is seeking a SOAR Engineer to join the Cyber Threat Detection team in the UK. You will enable CSIRT threat detection, automate responses, and mature security posture through orchestrated playbooks and analytics.

The role involves developing content for SOAR and SIEM, analyzing workflows, and guiding backlog refinements to meet strategic security objectives.

Qualifications

• Strong in threat detection and automation design.
• Experience with security orchestration and incident response.
• Proficiency across Linux and Windows environments.

Responsibilities

• Lead design and development of playbooks for SOAR and SIEM.
• Create automations to enrich alerts and incidents.
• Analyse workflows to improve speed and efficiency.
• Backlog management and requirement gathering for security automation.
• Develop content across security platforms to meet strategic goals.
• Analyze CSIRT functionality and implement improvements.

Skills

KQL

Detection engineering

SOAR

Linux

Windows

Azure

Azure Functions

Logic Apps

Python

PowerShell

REST APIs

AWS

Microsoft 365

Security Operations

Education

Bachelor’s degree in computer science or Cyber Security

Tools

Azure

AWS

Logic Apps

Job description

Select how often (in days) to receive an alert:

At National Gas, the work we do matters.

As Britain's national gas network, we help keep the lights on, businesses running, and homes warm bymaintainingthe critical infrastructure that transports gas across Great Britain. While providing the energy security Britain relies on today,we'realso helping transform the network for a clean energy future.

Join us and help secure Britain's energy.

About the role:

A crucial part of our Cyber Threat Detection team, the SOAR Engineer (security orchestration and automated response) ensures that National Gas can continuously keep up-to-date with new and emerging threats and ensures we can detect and respond to them.

• Enable the Computer Security Incident Response Team (CSIRT) to detect threats targeting the organisation through enrichment, tuning and automation, allowing the CSIRT to be more effective.
• Mature the cyber security posture of the business by leveraging automation and orchestrated response.

Key accountabilities:

• Subject Matter Expert for all things Threat Detection and security automation across the business.
• Analyse workflows and create automations to improve speed and efficiency.
• Develop tailored automations and enrichments for alerts/incidents across a wide range of security tools.
• Lead the design, development, and engineer new content (playbooks) across our security orchestration and response (SOAR) and security information and event management (SIEM) platforms to meet the organisation’s strategic objectives and goals.
• Assist with managing the Engineering backlog including researching backlog items, updating items, collecting requirements, feedback, etc and coming prepared to backlog refinement.
• Conduct in-depth analysis of the existing functionality of the CSIRT, propose and enact improvements to the service.

About you:

• Strong proficiency in KQL and detection engineering.
• Have a high level of ability to create and develop security orchestration and automated response (SOAR).
• Experience and working knowledge with operating systems – both Linux and Windows platforms.
• Extensive knowledge of Azure including Azure functions and Logic Apps.
• Familiarity with programming languages such as Python and PowerShell.
• Experience with cloud security tools and platforms (e.g., AWS, Azure, Microsoft 365).
• Experience working in Security Operation Centres, incident response and associated technologies.
• Understanding of REST API’s and demonstrate ability to develop and interact with REST API.
• Bachelor’s degree in computer science, Cyber Security, a related field, or suitable combination of education, experience and training.

What we can offer you:

• Market-leading double-match pension (for every £1 you add, we add £2)
• Annual performance bonus (up to 6%)
• 26 days holiday plus 8 statutory daysand option to buy 5 additional days
• 10x salary life assurance and income protection
• Flexible opt-in salary sacrifice benefits including private healthcare, car, dental, and technology schemes
• Family-friendly policies, wellbeing support, and professional development opportunities

Security clearance:

This role is subject to National Security Vetting (NSV). Candidates must be eligible to obtain and maintain Security Clearance (SC) throughout their employment. For further information, visit GOV.UK (UK Security Vetting: Clearance Levels).

Inclusive recruitment:

We'rebuilding a workforce that reflects the communities we serve, championing diversity, and creating an inclusive workplace where everyone is valued for their unique contribution. We support reasonable adjustments throughout the recruitment process and beyond.

National Gas is a Disability Confident employer and signatory of the Armed Forces Covenant.

#LI-PT1 #LI-Hybrid

Further information:

• Please note: there may be a requirement in the future for this position to be part of an on-call rota to support business continuity and respond to critical security incidents, further detail can be provided if selected for interview.