SOAR and Security Automation Engineer

Kirkland & Ellis; Chicago (IL); Hybrid; USD 133,000 - 166,000; Full time

Job summary

Kirkland & Ellis is seeking a SOAR & Security Automation Engineer in Chicago to design and scale automated workflows for rapid cyber incident response. You will work within the Cybersecurity Investigations & Response function, advancing SOAR, AI-powered automation, and enterprise security initiatives.

You will collaborate with SOC, detection, IT, and MSSP teams, translating operational gaps into automation opportunities while maintaining strong governance and compliance.

Qualifications

• Bachelor's degree in cybersecurity, information systems, or related field.
• 3–7+ years in cybersecurity, including hands-on SOAR/SOC/incidence response or security engineering.
• Proven design/maintain automation workflows using Cortex XSOAR or Google SecOps.
• Strong scripting skills in Python/PowerShell or similar.

Responsibilities

• Design, build, and continuously improve automation playbooks for incident types like phishing and identity compromise.
• Translate manual processes into scalable automated workflows to improve speed and accuracy.
• Administer and optimize SOAR platforms (Cortex XSOAR, Google SecOps) for reliability.
• Connect security technologies across SIEM, EDR, IAM, ticketing systems, and threat intel.
• Oversee end-to-end lifecycle: development, testing, deployment, tuning of automation solutions.
• Identify repetitive tasks and implement automation to reduce MTTR.
• Develop and track metrics to measure ROI of automation initiatives.
• Build AI-assisted workflows for triage and enrichment using LLMs.
• Collaborate with engineering/detection teams to evolve toward an agentic SOC.

Skills

SOAR design

Python

PowerShell

Cortex XSOAR

Google SecOps

Automation

Incident response

Security concepts

Cross-team collaboration

Communication

Education

Bachelor's degree in Cybersecurity or related field

Tools

Cortex XSOAR

Google SecOps

SIEM

EDR

Job description

At Kirkland & Ellis, we don’t just meet the standard for legal excellence — we set it. Our culture is built on teamwork, ingenuity and an unwavering commitment to continuous growth. We tackle the most sophisticated legal challenges with bold ideas and innovative solutions, powered by the exceptional experience and ambition of our 7,000+ people, including 4,000+ attorneys, across 24 offices worldwide. Our dedicated professionals share our lawyers’ commitment to excellence and show up each day to do meaningful work that helps drive global business, investment and innovation forward.

What You’ll Do

Are you passionate about transforming security operations through automation and AI? As a SOAR & Security Automation Engineer, you’ll design and scale intelligent workflows that power faster, smarter cyber incident response. You’ll play a critical role within the Cybersecurity Investigations & Response function, helping protect the firm from evolving threats while driving efficiency through Security Orchestration, Automation, and Response (SOAR) and emerging AI technologies.
Working within the Security Governance organization led by the Chief Information Security Officer (CISO), you’ll operate at the intersection of security, automation, and innovation. This is a high-impact role where sound judgment, attention to detail, and professionalism are essential as you support enterprise-wide security and compliance efforts.

• Design, build, and continuously improve automation playbooks for key incident types such as phishing, identity compromise, endpoint events, and threat intelligence.
• Translate manual investigation and response processes into scalable, automated workflows that improve accuracy and response speed.
• Administer and optimize SOAR platforms such as Palo Alto Cortex XSOAR and Google Security Operations (SecOps), ensuring reliability and performance.
• Connect and streamline security technologies across the ecosystem—including Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), identity and access management (IAM), ticketing systems, and threat intelligence platforms.
• Oversee end-to-end lifecycle activities including development, testing, deployment, and tuning of automation solutions.
• Identify repetitive, high-volume tasks and implement automation to reduce mean time to respond (MTTR) and improve signal-to-noise ratio.
• Develop and track performance metrics to measure the effectiveness, efficiency, and return on investment (ROI) of automation initiatives.
• Build and deploy AI-assisted workflows for triage, enrichment, and response using large language models (LLMs) and related tools.
• Collaborate with engineering and detection teams to evolve toward an agentic Security Operations Center (SOC) model.
• Partner with SOC, incident response, detection engineering, IT teams, and managed security service providers (MSSPs) to translate operational gaps into automation opportunities and continuously improve response processes.

What You’ll Bring

• Education & Certifications: Bachelor’s degree in Cybersecurity, Information Systems, or a related field (preferred); relevant certifications such as Palo Alto Networks Certified XSOAR Engineer, Google Cloud Professional Security Operations Engineer, or AI/automation credentials are a plus.
• Experience: 3–7+ years in cybersecurity, including hands-on work in SOAR, Security Operations Center (SOC), incident response, or security engineering.
• SOAR & Automation Expertise: Proven experience designing and maintaining automation workflows and playbooks using platforms like Cortex XSOAR or Google SecOps.
• Technical Skills: Strong scripting capabilities in Python, PowerShell, or similar languages to build scalable automation solutions.
• Security Operations Knowledge: Solid understanding of incident response lifecycle, SIEM, EDR, and threat intelligence practices.
• Framework Familiarity: Working knowledge of industry frameworks such as ISO 27001, National Institute of Standards and Technology (NIST) 800-53, Cybersecurity Framework (CSF), Center for Internet Security (CIS), and MITRE ATT&CK.
• Analytical Mindset: Ability to identify inefficiencies, solve complex problems, and translate operational needs into effective automation strategies.
• Collaboration & Communication: Strong interpersonal skills with the ability to work across teams and clearly communicate technical concepts to varied audiences.

Compensation

The base salary range below represents the low and high end of the salary range for this position in Chicago. This range may differ based on your geographic location and cost of living considerations. At Kirkland & Ellis, we consider compensation more than just a base salary. We offer an exceptional range of flexible benefits including comprehensive healthcare, paid time off, and retirement. We also offer personal support and tailored learning and development opportunities all designed to help you realize your full potential both in life and at work.

Compensation Range:

Chicago: $133,000 - $166,000

All employment decisions, including the recruiting, hiring, placement, training availability, promotion, compensation, evaluation, disciplinary actions, and termination of employment (if necessary) are made without regard to the employee’s race, color, creed, religion, sex, pregnancy or childbirth, personal appearance, family responsibilities, sexual orientation or preference, gender identity, political affiliation, source of income, place of residence, national or ethnic origin, ancestry, age, marital status, military veteran status, unfavorable discharge from military service, physical or mental disability, or on any other basis prohibited by applicable law. #LI-Hybrid #LI-CF1