Senior SOAR Engineer: Automation & Orchestration

EY; Lorida (FL); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Job summary

EY is seeking a Senior SOAR Engineer in Florida to design, implement, and optimize security automation workflows. You will integrate SIEM, EDR/XDR, and cloud security tools, build playbooks for incident triage, containment, and remediation, and mentor junior engineers.

You'll collaborate with SOC, IR, threat intelligence, and engineering teams to scale automation across AWS, Azure, and GCP environments while upholding security best practices and production reliability.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, MIS, or related field; 2-4 years of relevant experience.
• Hands-on experience with enterprise SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Phantom).
• Proficient in Python/PowerShell/JavaScript and REST API integrations.
• Experience designing automated incident triage, enrichment, containment, and remediation workflows.

Responsibilities

• Design, develop, and maintain automated security workflows to enhance security operations.
• Integrate security tools and data sources across the cybersecurity ecosystem.
• Build scalable playbooks for incident triage, enrichment, containment, and reporting.
• Mentor junior engineers and contribute to automation standards and reusable frameworks.
• Collaborate with SOC, IR, threat intel, detection, and vuln mgt teams.

Skills

SOAR engineering

Automation scripting

Python

REST APIs

SIEM integration

Cloud (Azure AWS GCP)

Security operations

Education

Bachelor's degree in CS / Cybersecurity / IT

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR / Phantom

Chronicle SOAR

Tines / D3 Security / Swimlane

Job description

EY is seeking a Senior SOAR Engineer in Florida to design, implement, and optimize security automation workflows. You will integrate SIEM, EDR/XDR, and cloud security tools, build playbooks for incident triage, containment, and remediation, and mentor junior engineers.

You'll collaborate with SOC, IR, threat intelligence, and engineering teams to scale automation across AWS, Azure, and GCP environments while upholding security best practices and production reliability.