Senior SOAR Engineer - Automate Security Ops

EY; Denver (CO); On-site; USD 105,000 - 219,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

401(k)

Paid time off

Job summary

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation across client environments. You will work with SOC, IR, Threat Intel, and Engineering to automate workflows, accelerate threat response, and orchestrate diverse security tools and data sources.

You’ll build scalable playbooks, integrate SIEM/EDR/IAM, and craft reusable automation frameworks while mentoring junior engineers and advancing EY’s cybersecurity engineering practice in a dynamic, global setting.

Qualifications

• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, IT, MIS, or related field, with 2–4 years in security automation or SOAR engineering.
• Hands-on experience implementing or developing solutions within enterprise SOAR platforms (e.g., Cortex XSOAR, Sentinel, Phantom, Chronicle SOAR, Tines, D3, Swimlane).
• Strong software development and scripting skills in Python, PowerShell, JavaScript, or equivalent.
• Experience building and consuming REST APIs, web services, SDKs, and custom integrations.
• Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case workflows.
• Experience integrating SIEM, EDR/XDR, IAM, cloud security, threat intel, and ticketing platforms.
• Understanding of infrastructure, networking, OS, and cloud (Azure, AWS, GCP).
• Experience designing, testing, debugging, and maintaining automation workflows in production.
• Knowledge of secure development practices, version control, testing, and CI/CD.

Responsibilities

• Design, develop, and maintain automated security workflows to enhance security operations.
• Integrate security tools, data sources, and processes across the cyber ecosystem.
• Collaborate with SOC, IR, Threat Intel, Detection Engineering, and Vulnerability teams to identify automation opportunities.
• Create playbooks for incident triage, enrichment, containment, remediation, and reporting.
• Develop custom integrations, API connectors, and automation capabilities across clouds and enterprise apps.
• Contribute to automation standards, reusable frameworks, and engineering best practices.
• Mentor junior engineers and support SOAR platform deployments and upgrades.
• Stay current on threats, automation tech, cloud-native security, and evolving SOAR solutions.

Skills

Security automation

SOAR engineering

Python

PowerShell

JavaScript

REST APIs

SIEM

EDR/XDR

Cloud platforms

Education

Bachelor's degree in Computer Science or related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR (Phantom)

Google Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation across client environments. You will work with SOC, IR, Threat Intel, and Engineering to automate workflows, accelerate threat response, and orchestrate diverse security tools and data sources.

You’ll build scalable playbooks, integrate SIEM/EDR/IAM, and craft reusable automation frameworks while mentoring junior engineers and advancing EY’s cybersecurity engineering practice in a dynamic, global setting.