Senior SOAR Engineer: Automate Security Operations

Ernst & Young Oman; Trenton (NJ); Remote; USD 105,000 - 219,000; Full time

Job summary

EY seeks a Senior SOAR Engineer to design, implement, and optimize automated security workflows that accelerate threat response. You will collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to automate repetitive tasks, orchestrate complex workflows, and integrate a wide range of security technologies across cloud environments.

The role requires strong scripting, API experience, and a track record of delivering scalable security automation solutions in production.

Qualifications

• Bachelor's degree and 2–4 years in security automation or SOAR.
• Hands-on experience with enterprise SOAR platforms.
• Strong scripting in Python/PowerShell/JavaScript.
• REST APIs, web services, SDKs, integrations.
• Knowledge of security operations processes and incident response.

Responsibilities

• Design, develop, and maintain automated security workflows.
• Integrate tools, data sources, and processes across cybersecurity ecosystem.
• Build playbooks for triage, enrichment, containment, remediation, reporting.
• Develop custom integrations, APIs, connectors across clouds and apps.
• Mentor juniors and contribute to automation standards.

Skills

Advanced problem-solving

Automation development

Software engineering

Mentoring junior team

Cross-functional collaboration

Education

Bachelor's degree in Computer Science / Cybersecurity / Information Technology

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR (Phantom)

Google Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY seeks a Senior SOAR Engineer to design, implement, and optimize automated security workflows that accelerate threat response. You will collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to automate repetitive tasks, orchestrate complex workflows, and integrate a wide range of security technologies across cloud environments.

The role requires strong scripting, API experience, and a track record of delivering scalable security automation solutions in production.