Senior Security Orchestration Architect - SOAR & AI Lead

Bank of America; Washington (District of Columbia); On-site; USD 170,000 - 250,000; Full time

Job summary

Bank of America is seeking a Security Incident Response Orchestration Lead to set the vision, architecture, and execution strategy for enterprise-scale security automation. You will drive cross-functional alignment across security operations, product, and engineering to transform incident response through automation and AI-enabled decisioning.

The role requires leading SOAR programs, defining governance and standards, and delivering measurable business outcomes through scalable automation across

Qualifications

• 10+ years in Security Operations, Incident Response, Detection Engineering, or Security Automation.
• 5+ years hands-on with Splunk SOAR (Phantom) and Tines in enterprise environments.
• Proven track record leading large-scale SOAR or automation programs.
• Deep expertise in incident response lifecycle, SOC operating models, and automation strategy.
• Experience integrating SOAR platforms with enterprise systems (Microsoft Graph, CrowdStrike, Tanium, ServiceNow, etc.)

Responsibilities

• Serve as the enterprise technical authority for security orchestration across Splunk SOAR and Tines.
• Define and evolve the long-term architecture, strategy, and roadmap for SOAR and automation platforms.
• Establish enterprise standards, reusable frameworks, and orchestration patterns to drive consistency and scale.
• Lead end-to-end design authority for complex, cross-platform automation initiatives.
• Partner with Product Management and senior leadership to shape portfolio prioritization and strategic investments.
• Drive intake governance model, ensuring automation demand is evaluated, prioritized, and aligned to measurable outcomes.
• Define and track enterprise value metrics (MTTR reduction, analyst efficiency, operational risk reduction, automation coverage).
• Influence and guide multiple security domain teams (15+ teams) to adopt standardized automation patterns and best practices.
• Provide technical leadership and mentorship to senior and principal engineers across SOAR platforms.
• Act as escalation point for high-risk, high-complexity orchestration challenges and systemic platform issues.
• Lead design and oversight of enterprise integrations, including Microsoft Graph / Entra ID / M365 Defender, CrowdStrike Falcon, Tanium, ServiceNow (Incidents, SecOps, CMDB, IR workflows).
• Drive platform reliability, resilience, and auditability standards across all automation implementations.

Skills

Influence

Stakeholder Management

Technical Strategy Development

Solution Design

Collaboration

Critical Thinking

DevOps Practices

Risk Management

Financial Management

Test Engineering

Access and Identity Management

Cyber Security

Information Systems Management

Job description

Bank of America is seeking a Security Incident Response Orchestration Lead to set the vision, architecture, and execution strategy for enterprise-scale security automation. You will drive cross-functional alignment across security operations, product, and engineering to transform incident response through automation and AI-enabled decisioning.

The role requires leading SOAR programs, defining governance and standards, and delivering measurable business outcomes through scalable automation across