SOAR Engineer - Splunk - SC Cleared

iO Associates; Greater Manchester; On-site; GBP 90,000 - 110,000; Full time

Benefits offered by this job

Remote-first

Private healthcare

Pension & life assurance

Training & certifications

Generous annual leave

Cycle-to-work

Job summary

iO Associates is seeking a Principal SOAR Engineer to lead design, architecture and delivery of advanced security automation solutions across enterprise environments. You will be the technical authority for SOAR engineering, partnering with Incident Response, SOC and Engineering teams to define automation strategy and drive improvements.

This is a remote-first role with occasional travel to customer sites across the UK.

Qualifications

• Extensive experience with Splunk platform stack and security analytics.
• Proven experience designing and implementing enterprise-scale security automation & orchestration.
• Strong understanding of SOC/IR operations and incident response workflows.

Responsibilities

• Lead design and architecture of enterprise-scale SOAR solutions on Splunk.
• Define automation strategy and opportunities to improve detection, investigation and response.
• Develop and optimize advanced SOAR playbooks and automated workflows.
• Act as technical authority for security automation, orchestration and analytics.
• Produce analytics and metrics to validate automation effectiveness.
• Mentor senior and junior SOAR engineers and provide technical leadership.

Skills

Splunk Enterprise

Splunk Enterprise Security

Splunk SOAR

Splunk UBA

Automation

Job description

Location: Remote (UK) with occasional travel to customer sites as required
Salary: Up to £100,000 + excellent benefits

About the Role

We are seeking a Principal SOAR Engineer to lead the design, architecture and delivery of advanced security automation solutions across enterprise environments. As the technical authority for SOAR engineering, you will work closely with Incident Response, Security Operations and Engineering teams to define automation strategy, develop scalable playbooks and drive continuous improvements in cyber defence capabilities.

This is a predominantly remote position with occasional travel to customer sites for workshops, technical engagements and project delivery.

Key Responsibilities

• Lead the design and architecture of enterprise-scale SOAR solutions using the Splunk platform.
• Define automation strategy and identify opportunities to improve detection, investigation and response capabilities.
• Design, develop and optimise advanced SOAR playbooks and automated workflows.
• Act as the technical authority for security automation, orchestration and analytics.
• Produce system analytics and performance metrics to validate automation effectiveness.
• Develop and implement new security use cases to enhance SOC efficiency and reduce response times.
• Ensure all changes follow established change management and governance processes.
• Conduct peer reviews and quality assurance for automation developed by the engineering team.
• Mentor and provide technical leadership to senior and junior SOAR engineers.
• Collaborate with customers and internal stakeholders to translate operational requirements into scalable automation solutions.
• Contribute to technical roadmaps, best practices and continuous improvement initiatives.

Required Skills & Experience

• Extensive experience with:
  • Splunk Enterprise
  • Splunk Enterprise Security (ES)
  • Splunk SOAR (formerly Phantom)
  • Splunk User Behaviour Analytics (UBA)
• Proven experience designing and implementing enterprise-scale security automation and orchestration.
• Strong understanding of Security Operations and Incident Response.
• Deep knowledge of security frameworks including:
  • MITRE ATT&CK
  • NIST Cybersecurity Framework
• Experience with Windows, Linux/UNIX and database technologies.
• Strong scripting and automation skills, ideally with Python, alongside experience with Java, Perl or C++.
• Experience creating dashboards, analytics and reporting to demonstrate automation performance and effectiveness.
• Ability to influence technical direction and provide strategic guidance to engineering teams.
• Critical National Infrastructure (CNI) or regulated industry experience.
• Knowledge of NIS Regulations and the NCSC Cyber Assessment Framework (CAF).
• Understanding of both IT and Operational Technology (OT) security.
• Experience integrating Splunk SOAR with OT security platforms such as Nozomi, Claroty or Dragos.
• Experience developing complex SOAR playbooks and enterprise automation frameworks.
• Experience acting as a technical lead or principal engineer within a SOC or cyber security consultancy.

What’s on Offer

• Salary up to £100,000
• Remote-first working with occasional customer site visits.
• Flexible working arrangements.
• Generous annual leave with the option to purchase additional days.
• Private healthcare and wellbeing support.
• Pension, life assurance and employee savings schemes.
• Electric vehicle and cycle-to-work schemes.
• Enhanced family leave and wellbeing benefits.
• Ongoing investment in training, certifications and professional development.