Senior SOAR Engineer: Automate Threat Response & Orchestration

EY; Detroit (MI); On-site; USD 105,000 - 192,000; Full time

Job summary

EY seeks a Senior SOAR Engineer to design, implement, and optimize security automation solutions across enterprises. You will integrate SIEM/EDR/IAM, develop playbooks, and orchestrate workflows that reduce response times and improve threat visibility.

This role requires strong scripting, platform engineering, and collaboration with SOC, IR, and engineering teams. You will mentor junior engineers, help mature automation standards, and stay current on cloud-native security and new SOAR

Qualifications

• Bachelor’s degree in a related field with 2–4 years of relevant experience.
• Hands-on experience with enterprise SOAR platforms (XSOAR, Phantom, SWIMLANE, etc.).
• Strong coding and scripting experience for automation and integrations.
• Experience building REST API integrations and custom connectors.

Responsibilities

• Design, develop, and maintain automated security workflows and playbooks.
• Integrate SIEM, EDR/XDR, IAM, cloud security, and ticketing platforms.
• Engineer scalable automation across cloud and on‑prem environments.
• Mentor junior engineers and contribute to automation standards.
• Stay current on evolving SOAR solutions and automation trends.

Skills

Python

PowerShell

JavaScript

Scripting

REST APIs

Automation

Platform engineering

Education

Bachelor's degree in CS/Engineering/IT/c Cybersecurity

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR (Phantom)

Google Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY seeks a Senior SOAR Engineer to design, implement, and optimize security automation solutions across enterprises. You will integrate SIEM/EDR/IAM, develop playbooks, and orchestrate workflows that reduce response times and improve threat visibility.

This role requires strong scripting, platform engineering, and collaboration with SOC, IR, and engineering teams. You will mentor junior engineers, help mature automation standards, and stay current on cloud-native security and new SOAR