Enterprise Security Orchestration Lead (SOAR)

Bank of America; Chicago (IL); On-site; USD 150,000 - 190,700; Full time

Job summary

Bank of America is seeking a Security Incident Response Orchestration Lead in Chicago to set the vision and execute enterprise-grade security automation across SOAR platforms such as Splunk SOAR and Tines. You will drive cross‑functional alignment with security operations, product management, engineering, and executive leadership to transform incident response through automation and AI-enabled decisioning.

The role requires 10+ years in security operations and 5+ years with SOAR tooling, plus a

Qualifications

• 10+ years of experience in Security Operations, Incident Response, Detection Engineering, or Security Automation.
• 5+ years with Splunk SOAR (Phantom) and hands-on experience with Tines in enterprise environments.
• Proven track record of leading large-scale SOAR or automation programs.
• Deep expertise in incident response lifecycle, SOC operating models, and automation strategy.

Responsibilities

• Serve as enterprise technical authority for security orchestration across Splunk SOAR and Tines.
• Define and evolve long-term architecture, strategy, and roadmap for SOAR and automation platforms.
• Establish enterprise standards, reusable frameworks, and orchestration patterns to drive consistency and scale.
• Lead end-to-end design authority for complex, cross-platform automation initiatives.
• Partner with Product Management and senior leadership to shape portfolio prioritization and strategic investments.
• Drive intake governance model, ensuring automation demand is evaluated and aligned to outcomes.
• Define and track enterprise value metrics (MTTR reduction, analyst efficiency, operational risk reduction).
• Influence multiple security domain teams to adopt standardized automation patterns and best practices.
• Provide technical leadership and mentorship to senior engineers across SOAR platforms.
• Lead design and oversight of enterprise integrations (Microsoft Graph, CrowdStrike, Tanium, ServiceNow, etc.).
• Ensure platform reliability, resilience, and auditability standards across automation implementations.

Skills

SOAR

Automation

Security Operations

Incident Response

Architectural Design

Leadership

Cross‑functional Collaboration

Stakeholder Management

Python

DevOps Practices

Risk Management

Technical Strategy

Compliance

Cloud Security

Governance

Job description

Bank of America is seeking a Security Incident Response Orchestration Lead in Chicago to set the vision and execute enterprise-grade security automation across SOAR platforms such as Splunk SOAR and Tines. You will drive cross‑functional alignment with security operations, product management, engineering, and executive leadership to transform incident response through automation and AI-enabled decisioning.

The role requires 10+ years in security operations and 5+ years with SOAR tooling, plus a