SOAR Engineer

National Gas; Warwick; On-site; GBP 65,000 - 100,000; Full time

Benefits offered by this job

Double-match pension

Annual bonus (up to 6%)

26 days holiday + 8 statutory days + 5

additional days

10x salary life assurance

Private healthcare

Car, dental, and technology schemes

Job summary

National Gas is seeking a skilled SOAR Engineer to join the Cyber Threat Detection team in the UK. You will drive security automation, develop playbooks, and ensure detection and response keep pace with evolving threats.

You will work across Linux and Windows environments, leverage Azure Functions and Logic Apps, and collaborate with CSIRT to mature the organization’s security posture through automation and orchestration.

Qualifications

• Strong proficiency in KQL and detection engineering.
• High level of ability to create and develop security orchestration and automated response (SOAR).
• Experience with operating systems – Linux and Windows.
• Extensive knowledge of Azure including Azure functions and Logic Apps.
• Familiarity with Python and PowerShell.
• Experience with cloud security tools and platforms (AWS, Azure, Microsoft 365).
• Experience in Security Operations Centres, incident response and related technologies.
• Understanding of REST APIs and ability to develop and interact with them.
• Bachelor’s degree in Computer Science or Cyber Security or related field.

Responsibilities

• Subject Matter Expert for Threat Detection and security automation across the business.
• Analyse workflows and create automations to improve speed and efficiency.
• Develop tailored automations and enrichments for alerts/incidents across security tools.
• Lead design, development, and engineer new content (playbooks) across SOAR and SIEM platforms.
• Assist with managing the Engineering backlog including research, requirements, and backlog refinement.
• Conduct in-depth analysis of CSIRT functionality and propose improvements to the service.

Skills

KQL

Detection engineering

SOAR development

Linux

Windows

Azure

Azure Functions

Logic Apps

Python

PowerShell

AWS

Microsoft 365

REST APIs

Security Operations Centers

Incident response

Education

Bachelor's degree in Computer Science or Cyber Security

Tools

Azure Functions

Logic Apps

AWS

Microsoft 365

REST APIs

Job description

At National Gas, the work we do matters.

As Britain's national gas network, we help keep the lights on, businesses running, and homes warm by maintaining the critical infrastructure that transports gas across Great Britain. While providing the energy security Britain relies on today, we're also helping transform the network for a clean energy future.

Join us and help secure Britain's energy.

About the role:

A crucial part of our Cyber Threat Detection team, the SOAR Engineer (security orchestration and automated response) ensures that National Gas can continuously keep up-to-date with new and emerging threats and ensures we can detect and respond to them.

• Enable the Computer Security Incident Response Team (CSIRT) to detect threats targeting the organisation through enrichment, tuning and automation, allowing the CSIRT to be more effective.
• Mature the cyber security posture of the business by leveraging automation and orchestrated response.

Key accountabilities:

• Subject Matter Expert for all things Threat Detection and security automation across the business.
• Analyse workflows and create automations to improve speed and efficiency.
• Develop tailored automations and enrichments for alerts/incidents across a wide range of security tools.
• Lead the design, development, and engineer new content (playbooks) across our security orchestration and response (SOAR) and security information and event management (SIEM) platforms to meet the organisation’s strategic objectives and goals.
• Assist with managing the Engineering backlog including researching backlog items, updating items, collecting requirements, feedback, etc and coming prepared to backlog refinement.
• Conduct in-depth analysis of the existing functionality of the CSIRT, propose and enact improvements to the service.

About you:

• Strong proficiency in KQL and detection engineering.
• Have a high level of ability to create and develop security orchestration and automated response (SOAR).
• Experience and working knowledge with operating systems – both Linux and Windows platforms.
• Extensive knowledge of Azure including Azure functions and Logic Apps.
• Familiarity with programming languages such as Python and PowerShell.
• Experience with cloud security tools and platforms (e.g., AWS, Azure, Microsoft 365).
• Experience working in Security Operation Centres, incident response and associated technologies.
• Understanding of REST API’s and demonstrate ability to develop and interact with REST API.
• Bachelor’s degree in computer science, Cyber Security, a related field, or suitable combination of education, experience and training.

What we can offer you:

• Market-leading double-match pension (for every £1 you add, we add £2)
• Annual performance bonus (up to 6%)
• 26 days holiday plus 8 statutory days and option to buy 5 additional days
• 10x salary life assurance and income protection
• Flexible opt-in salary sacrifice benefits including private healthcare, car, dental, and technology schemes
• Family-friendly policies, wellbeing support, and professional training and development opportunities

Security clearance:

This role is subject to National Security Vetting (NSV). Candidates must be eligible to obtain and maintain Security Clearance (SC) throughout their employment. For further information, visit GOV.UK (UK Security Vetting: Clearance Levels).

Inclusive recruitment:

We’re building a workforce that reflects the communities we serve, championing diversity, and creating an inclusive workplace where everyone is valued for their unique contribution. We support reasonable adjustments throughout the recruitment process and beyond.

National Gas is a Disability Confident employer and signatory of the Armed Forces Covenant.

Further information:

• Please note: there may be a requirement in the future for this position to be part of an on-call rota to support business continuity and respond to critical security incidents, further detail can be provided if selected for interview.