Senior SOAR Engineer: Automation & Incident Response

EY; Rogers (AR); On-site; USD 120,000 - 190,000; Full time

Job summary

EY seeks a Senior SOAR Engineer to design, implement, and optimize security automation solutions across enterprise environments.

You will collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to automate workflows, integrate SIEM/EDR/IAM, and deliver scalable integrations.

The role emphasizes leadership, mentoring, and staying current with emerging SOAR platforms and cloud-native security capabilities.

Qualifications

• Bachelor's degree required with 2–4 years of related experience in security automation or SOAR engineering.
• Hands-on experience implementing, administering, or developing enterprise SOAR platforms.
• Strong software development and scripting skills in Python, PowerShell, JavaScript, or similar.
• Experience developing and consuming REST APIs, web services, SDKs, and custom integrations.

Responsibilities

• Design, develop, and maintain automated security workflows to enhance SOC operations.
• Integrate security tools, data sources, and processes across the cybersecurity ecosystem.
• Collaborate with SOC, IR, threat intel, and engineering teams to automate tasks and orchestrate workflows.
• Create and maintain playbooks for incident triage, containment, remediation, and reporting.

Skills

Python

PowerShell

JavaScript

REST APIs

Automation

Education

Bachelor's degree in Computer Science or related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR (Phantom)

Google Chronicle SOAR

Tines

D3 Security

Swimlane

Job description

EY seeks a Senior SOAR Engineer to design, implement, and optimize security automation solutions across enterprise environments.

You will collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to automate workflows, integrate SIEM/EDR/IAM, and deliver scalable integrations.

The role emphasizes leadership, mentoring, and staying current with emerging SOAR platforms and cloud-native security capabilities.