Senior SOAR Engineer: Automation & Security Orchestration

Ernst & Young Oman; Huntsville (AL); On-site; USD 126,000 - 210,000; Full time

Job summary

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that boost incident response efficiency. You will work with SOC, IR, Threat Intelligence, and Engineering to automate workflows and integrations across SIEM, EDR, IAM, cloud security, and ticketing systems.

The role requires strong scripting, REST API development, and production-grade automation experience.

Qualifications

• Bachelor’s degree (4-year) in Computer Science, Computer Engineering, Cybersecurity, Information Technology, MIS, or related field with 2–4 years of relevant experience.
• Hands-on experience with enterprise SOAR platforms such as Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Chronicle SOAR, Tines, D3 Security, Swimlane, or similar technologies.
• Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
• Experience developing and consuming REST APIs, web services, SDKs, and custom integrations.
• Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case management workflows.
• Experience integrating cybersecurity technologies such as SIEM, EDR/XDR, IAM, email security, network security, cloud security, threat intelligence, and ticketing platforms.
• Understanding of infrastructure, networking, OS and cloud environments (Azure, AWS, GCP).
• Experience designing, testing, troubleshooting, and maintaining automation workflows in production.
• Knowledge of secure development principles, version control, testing methodologies, and CI/CD concepts.
• Relevant certifications or ability to acquire them after employment.

Responsibilities

• Design, develop, and maintain automated security workflows to enhance security operations.
• Implement and optimize SOAR platforms by integrating tools, data sources, and processes.
• Collaborate with SOC, Incident Response, Threat Intelligence, and Engineering teams to automate tasks.
• Design and develop playbooks for incident triage, enrichment, containment, remediation, and reporting.
• Develop integrations and connectors across cloud environments and enterprise apps.
• Contribute to automation standards, reusable frameworks, and best practices.
• Mentor junior engineers and provide technical leadership on security automation initiatives.

Skills

Security automation

SOAR engineering

Security operations

Cybersecurity engineering

Python

PowerShell

Education

Bachelor’s degree in CS/CE/Cybersecurity/IT/MIS

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

REST APIs

Job description

EY is seeking a Senior SOAR Engineer to design, implement, and optimize security automation solutions that boost incident response efficiency. You will work with SOC, IR, Threat Intelligence, and Engineering to automate workflows and integrations across SIEM, EDR, IAM, cloud security, and ticketing systems.

The role requires strong scripting, REST API development, and production-grade automation experience.