Senior SOAR Engineer

Sampoorna Consultants; Mumbai; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

Sampoorna Consultants in Mumbai is seeking an experienced Senior SOAR Engineer to design, build, and maintain automated playbooks and integrations within the SOAR platform. The role focuses on automation engineering, API integrations, scripting, and orchestration of security tools to streamline incident response processes.

Responsibilities include designing playbooks for phishing investigations, malware alerts, and suspicious authentication, building REST API integrations with SIEMs, EDR/XDR,

Qualifications

• 5-6 years of hands-on enterprise SIEM experience.
• Strong playbook building and SOAR management experience.
• Experience with REST APIs, JSON/XML parsing, and webhooks.
• Ability to convert runbooks into automated workflows.

Responsibilities

• Design and build automated playbooks for incident types such as phishing investigations, malware alerts, suspicious authentication, and privilege misuse enrichment workflows.
• Implement conditional logic (if/else), loops, parallel execution, automated enrichment steps, escalation and approval workflows.
• Convert manual SOC runbooks into fully automated workflows.
• Build dynamic playbooks driven by alert severity and risk scores.
• Develop integrations with SIEM, EDR/XDR, Firewall, Email security platforms, IAM, threat intel platforms, and ticketing systems such as ServiceNow.
• Build custom integrations with REST APIs, Webhooks, and Python-based connectors.
• Conduct regression testing after playbook creation/updates using synthetic data.
• Troubleshooting failed automation, runbooks, and integration errors.
• Maintain end-to-end documentation from conceptual requirements to playbook production and sign-offs.

Skills

SIEM platform experience

Python scripting

PowerShell

Bash

REST APIs

JSON parsing

XML parsing

Webhooks

Automation playbooks

SOAR management

Tools

ServiceNow

Job description

Senior SOAR Engineer - J50695

Role & responsibilities

Job Location: Airoli, Navi Mumbai (Client Location)

5 days Work from Office - General Shift

About the Role

We are looking for an experienced and driven SOAR Engineer to join our growing SOC Services team. The candidate will be responsible for designing, building, and maintaining automated playbooks and integrations within the SOAR platform. The role focuses on automation engineering, API integrations, scripting, and the orchestration of security tools to streamline incident response processes.

Key Responsibilities

• Design and build automated playbooks for incident types such as: Phishing investigations, Malware alerts, Suspicious authentication, Privilege misuse enrichment workflows.
• Implement conditional logic (if/else, loops), Parallel execution flows, Automated enrichment steps, Escalation and approval workflows.
• Convert manual SOC runbooks into fully automated workflows.
• Build dynamic playbooks driven by alert severity and risk score.
• Develop integrations with- SIEM, EDR/XDR, Firewall, Email security platforms, IAM, threat Intelligence platforms, ticketing systems such as Service Now.
• Build custom integrations with REST APIs, Web hooks, and Python-based connectors.
• Conduct regression testing after playbook creation/updates using synthetic data.
• Troubleshooting failed automation, runbooks, and integration errors.
• Maintain end-to-end documentation from conceptual, requirement gathering, to playbook production- sign-offs.

Required technical skill sets

• Hands-on experience with at least one SIEM platform.
• Strong Python scripting skills (mandatory) with knowledge of PowerShell/bash.
• Experience with rest APIs, JSON & XML parsing, API authentication mechanisms, Webhooks.
• Experience developing custom connectors.
• Experience with SIEM architecture, SOC incident response lifecycle, MIRTE Framework.

Required Experience

• 5-6 years of hands-on experience in managing an enterprise SIEM platform.
• Strong playbook building knowledge.
• Proven track record in SOAR management, playbook building, and new data sources and integration.