Senior SOAR Engineer

malomatia; Doha; On-site; QAR 200,000 - 350,000; Full time

Job summary

malomatia is seeking a seasoned SOAR Engineer in Doha to monitor, develop, and maintain cyber security automation across our MSSP/MDR services. You will drive incident response automation, platform administration, and content lifecycle management, collaborating with SOC and Security Engineering teams to deliver resilient security solutions.

The ideal candidate has 6+ years in SOAR ecosystems, strong API development skills, and experience integrating tools with ITSM systems.

Qualifications

• Bachelor's degree in Engineering, Economics, CS or related field.
• One or more SOAR certificates related to a SOAR platform.

Responsibilities

• Act as Technical Subject Matter Expert for Security Automation and Orchestration.
• Develop and execute procedures for SOAR platform administration.
• Design, deploy and maintain SOAR platforms, including content and lifecycle management.
• Collaborate with SOC and Security Engineering to improve automation.
• Improve SOC processes by integrating automation in SOAR tools.
• Implement automation and ensure compatibility with detection/response tools.
• Integrate new sources and build playbooks for incident triage and response.
• Develop scripts to automate detection and response workflows.
• Build pipelines to enrich logs and provide SOC analysts with comprehensive views.
• Operate and mature SOC playbooks, workflows and use cases.
• Assist with client onboarding and act as primary contact for MSSP/MDR clients.

Skills

SOAR technologies

API development

Incident Response

SOC processes

Dashboards & reports

OS internals

SOAR integrations

ITSM integrations

Problem solving

Communication

Education

Bachelor's degree in Engineering/CS/Economics

SOAR certificate

Tools

Palo Alto Cortex XSOAR

Splunk SOAR/Phantom

Microsoft Sentinel Automation/Logic Apps

IBM Resilient

Job description

Our SOAR Engineer is responsible for monitoring, developing, and maintaining the beating heart of malomatia Cyber Security Services and driving our efficiency improvements. The effective use of our tools and expertise is critical to ensure malomatia and our customers can quickly identify, understand, and respond to cyber security incidents. The successful candidate will have a good technical knowledge of cyber systems and incident response, and a desire to drive improvements through automation. They should possess an understanding of different security technologies, technical infrastructures and APIs and an awareness of cyber threats.

ROLES & RESPONSIBILITIES:

• Act as a Technical Subject Matter Expert, be the primary point of contact for Security Automation, Orchestration, Playbooks, Python Automation, API-based automation, Incident Response lifecycle automation, Security Automation
• Develop, implement, and execute standard procedures for SOAR platform administration.
• Design, Deployment and Maintenance of SOAR platforms (including content management, change management, version/patch management, and lifecycle management).
• Work closely with the Security Operations Center (SOC) and Security Engineering teams to improve existing automation and deliver resilient security solutions
• Assess, design, and improve SOC processes and workflows with a focus on integrating automation through Security Orchestration, Automation and Response (SOAR) tools.
• Implement SOC automation and ensure continued compatibility with existing detection and response tools.
• Integrate new sources and build playbooks to properly triage and respond to security incidents while reducing the time needed to analyze each event.
• Develop custom scripts to automate current detection and response workflows.
• Build pipelines to enrich logs and alert results to provide a comprehensive view for SOC analysts.
• Operate and help mature a SOC playbook, workflow automations and use cases
• Assist with client setup transition and onboarding, serve as primary point of contact for Managed Security Service client

JOB SPECIFICATIONS:

Education:

• Bachelor's degree in Engineering, Economics, Computer Science, or a related discipline.
• Additionally, one or more SOAR certificate related to a SOAR platform

Experience:

• Minimum 6+ years of relevant experience working on Security Orchestration, Automation and Response (SOAR) technologies

Skills:

• Proven experience with Security Orchestration, Automation and Response (SOAR) technologies (e.g., Palo Alto Cortex XSOAR, Splunk SOAR/Phantom, Microsoft Sentinel Automation/Logic Apps, IBM Resilient).
• Understanding of security architecture, tool integration, API development and automation.
• Understanding of Incident Response processes (Detection, Investigation, and response).
• Understanding of common SOC processes and workflows.
• Experience developing Dashboards and Reports focused on cyber security operations.
• Experience with operating system internals for both Linux and Windows platforms.
• Proven experience building or customizing integrations/playbooks with common security tools (e.g., Palo Alto/Fortinet firewalls, CrowdStrike/SentinelOne EDR, Splunk/QRadar/Sentinel SIEM, ServiceNow/Jira ticketing).
• Proven experience integrating SOAR platforms with ITSM systems (e.g., Jira, ServiceNow etc).
• Strong problem-solving capabilities and the ability to work with minimal oversight.
• Exceptional written and verbal communication skills.

Technical Skills:

• Familiarity and experience working within the region
• Experience working as part of a MSSP or MDR provider