Senior SOAR Engineer — Automation & Incident Orchestration

EY; New York (NY); On-site; USD 126,000 - 210,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that accelerate threat response. You will collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to build scalable playbooks and integrations across cloud and on-prem environments.

You will mentor junior engineers, contribute to automation frameworks, and stay current on emerging security automation trends and cloud-native capabilities.

Qualifications

• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, IT, MIS or related field with 2–4 years of related experience.
• Hands-on experience implementing or developing enterprise SOAR platforms (XSOAR, Splunk Phantom, Swimlane, etc.).
• Strong software development and scripting skills (Python, PowerShell, JavaScript).
• Experience with REST APIs, web services, and custom integrations.

Responsibilities

• Design, develop, and maintain automated security workflows to optimize security operations.
• Integrate security tools, data sources, and processes across SOC, IR, detection, and engineering teams.
• Create playbooks for triage, enrichment, containment, remediation, and reporting.
• Mentor junior engineers and contribute to automation standards and best practices.

Skills

Python

REST APIs

SOAR

Security automation

Cloud security

SIEM

Education

Bachelor’s degree in Computer Science or related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Google Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that accelerate threat response. You will collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to build scalable playbooks and integrations across cloud and on-prem environments.

You will mentor junior engineers, contribute to automation frameworks, and stay current on emerging security automation trends and cloud-native capabilities.