Senior SOAR Engineer: Automate & Orchestrate Cyber Ops

Ernst & Young Oman; Jacksonville (FL); On-site; USD 105,000 - 192,000; Full time

Job summary

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that improve threat response across clients. You will work with SOC, Incident Response, Threat Intel, Detection Engineering, and Vulnerability teams to automate workflows and integrate SIEM/EDR/XDR across cloud and on‑prem environments.

The role emphasizes scripting, API integrations, and scalable playbooks for incident triage, enrichment, and reporting, with opportunities to mentor peers and

Qualifications

• Bachelor’s degree in relevant field with 2–4 years in security automation or SOAR engineering.
• Hands-on experience with enterprise SOAR platforms listed above.
• Strong programming and scripting in Python, PowerShell, JavaScript.

Responsibilities

• Design, develop, and maintain automated security workflows to enhance security operations.
• Integrate security tools, data sources, and processes across the cybersecurity ecosystem.
• Mentor junior team members and contribute to security automation standards.
• Develop playbooks for triage, containment, remediation, and reporting.

Skills

SOAR architecture

Python

PowerShell

JavaScript

REST APIs

SIEM integration

EDR/XDR

Cloud platforms (Azure/AWS/GCP)

CI/CD concepts

Security operations

Education

Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, MIS, or related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR (Phantom)

Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that improve threat response across clients. You will work with SOC, Incident Response, Threat Intel, Detection Engineering, and Vulnerability teams to automate workflows and integrate SIEM/EDR/XDR across cloud and on‑prem environments.

The role emphasizes scripting, API integrations, and scalable playbooks for incident triage, enrichment, and reporting, with opportunities to mentor peers and