Senior SOAR Engineer: Automate, Orchestrate & Defend

Ernst & Young Oman; Topeka (KS); Remote; USD 105,000 - 210,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking a Senior SOAR Engineer to design, implement, and optimize automated security workflows that improve threat response and orchestration across security operations.You'll collaborate with SOC, incident response, threat intel, and engineering teams to reduce response times and maximize security investments.

The role emphasizes developing playbooks, integrating SIEM/EDR/IAM, and mentoring junior engineers while staying current on evolving SOAR solutions and cloud-native security

Qualifications

• Bachelor's degree in a related field and 2–4 years in security automation or SOAR engineering.
• Hands-on experience with enterprise SOAR platforms.
• Strong software development and scripting skills in Python/PowerShell/JavaScript.
• Experience building REST APIs, integrations, and automations.

Responsibilities

• Design, develop, and maintain automated security workflows for SOC operations.
• Integrate security tools, data sources, and processes across environments.
• Create playbooks for incident triage, enrichment, containment, remediation and reporting.
• Develop custom integrations, APIs, connectors, and cloud-based automation.
• Mentor junior engineers and contribute to security automation practices.

Skills

SOAR engineering

Security automation

Python

PowerShell

JavaScript

REST APIs

CI/CD

Cloud platforms

Education

Bachelor's degree in CS/CE/IT or related

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR (Phantom)

Google Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a Senior SOAR Engineer to design, implement, and optimize automated security workflows that improve threat response and orchestration across security operations.You'll collaborate with SOC, incident response, threat intel, and engineering teams to reduce response times and maximize security investments.

The role emphasizes developing playbooks, integrating SIEM/EDR/IAM, and mentoring junior engineers while staying current on evolving SOAR solutions and cloud-native security