Lead SOAR Engineering Manager – Security Automation

EY; Milwaukee (WI); On-site; USD 145,000 - 302,000; Full time

Benefits offered by this job

Medical coverage

Pension plan

401(k) plan

Paid time off

Job summary

EY seeks a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions. You will guide end‑to‑end SOAR engagements, architect scalable integrations, and mentor diverse teams across security operations and incident response.

You will partner with clients to shape automation strategies, governance, and platform roadmaps, delivering measurable value from cybersecurity investments. EY offers a comprehensive rewards package and a global, inclusive culture.

Qualifications

• Bachelor’s degree and 6–10 years in security automation, SOAR engineering, or related fields.
• Experience leading teams or workstreams delivering security automation or SOAR projects in enterprise environments.
• Hands‑on with enterprise SOAR platforms (e.g., Cortex XSOAR, Sentinel Automation, Splunk SOAR, Swinlane, Tines).
• Strong software development and scripting using Python, PowerShell, JavaScript, or similar.
• Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
• Strong knowledge of SOC processes: alert triage, incident response, threat detection and intelligence, vulnerability management, case management.
• Proven ability to integrate security technologies across SIEM, EDR/XDR, IAM, cloud, email, network, vulnerability management, ticketing and collaboration tools.
• Understanding of infrastructure, networking, OS and cloud platforms (Azure, AWS, GCP).
• Ability to lead client‑facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders.
• Certifications or ability to obtain applicable certifications after employment.

Responsibilities

• Lead end‑to‑end SOAR engagements from discovery through architecture, implementation, testing, deployment, and operation.
• Advise clients on automation strategy, operating models, governance, and roadmaps for SOC improvement.
• Own solution architecture and delivery quality for enterprise SOAR implementations.
• Design and develop playbooks for incident triage, enrichment, investigation, containment, remediation, and reporting.
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, and collaboration tools.
• Provide oversight for custom integrations, APIs, connectors, and reusable automation components.
• Facilitate architecture reviews, workshops, and stakeholder interviews; translate findings into actionable plans.
• Manage engagement scope, milestones, risks, staffing, and budget while ensuring service quality.
• Establish engineering standards, governance, testing, and production support models for automation.
• Lead, mentor, and develop multidisciplinary teams; drive inclusive, collaborative environment.
• Identify follow‑on opportunities, contribute to proposals and SOWs, grow the security automation practice.

Skills

Security automation

SOAR engineering

Security operations

Leadership

Client advisory

Architecture design

REST APIs

CI/CD

Python scripting

Cloud platforms

Education

Bachelor's degree in CS/CE/related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Tines

D3 Security

Swimlane

Job description

EY seeks a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions. You will guide end‑to‑end SOAR engagements, architect scalable integrations, and mentor diverse teams across security operations and incident response.

You will partner with clients to shape automation strategies, governance, and platform roadmaps, delivering measurable value from cybersecurity investments. EY offers a comprehensive rewards package and a global, inclusive culture.