Senior SOAR Engineer: Automate Threat Response

EY; Wichita (KS); On-site; USD 105,000 - 192,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that help clients detect threats faster. You will collaborate with SOC, IR, threat intelligence, and engineering teams to automate workflows, integrate tools, and deliver scalable security operations improvements.

The role requires hands-on scripting in Python/PowerShell/JavaScript, experience with SOAR platforms such as Cortex XSOAR and Splunk Phantom, and the ability to mentor junior engineers

Qualifications

• Bachelor's degree and 2–4 years in security automation or SOAR engineering.
• Hands-on experience implementing enterprise SOAR platforms (Cortex XSOAR, Splunk Phantom, etc.).
• Strong software development and scripting skills in Python/PowerShell/JavaScript.
• Experience building REST APIs, web services, SDKs, and custom integrations.

Responsibilities

• Design, develop, and maintain automated security workflows for SOAR platforms.
• Integrate security tools, data sources, and operational processes across the security ecosystem.
• Mentor junior team members and provide technical leadership on automation initiatives.
• Collaborate with SOC, Incident Response, Threat Intel, and Engineering teams to automate incidents.
• Develop playbooks for triage, enrichment, containment, remediation, and reporting.

Skills

Python

PowerShell

JavaScript

Automation development

Security engineering

Mentoring

Education

Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, IT, MIS

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that help clients detect threats faster. You will collaborate with SOC, IR, threat intelligence, and engineering teams to automate workflows, integrate tools, and deliver scalable security operations improvements.

The role requires hands-on scripting in Python/PowerShell/JavaScript, experience with SOAR platforms such as Cortex XSOAR and Splunk Phantom, and the ability to mentor junior engineers