SOAR Automation Engineer

BlackCube Labs; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

Randstad in Washington, DC is hiring an SOAR Automation Engineer for a hybrid role that bridges security operations with automation engineering. You will design and deploy automated playbooks, API connectors, and dashboards across cloud and on‑prem environments.

You will lead technical discovery, translate security and business needs into technical specs, and optimize risk triage and remediation processes within enterprise SecOps teams.

Qualifications

• Hands-on experience building, testing, and deploying custom playbooks and integrations within leading SOAR platforms.
• Proficiency with RESTful APIs, JSON/XML parsing, scripting, and integrating hybrid environments (AWS, Azure, M365, ITSM).
• Strong understanding of Incident Response lifecycle, threat mitigation, and security operations workflows.
• Hybrid technical analyst able to translate requirements into architecture docs and testable criteria.
• Excellent written and verbal communication; able to work near Washington, DC for hybrid onboarding.

Responsibilities

• Design, build, and maintain automated playbooks, workflows, and API connectors across systems.
• Lead technical discovery sessions to gather requirements and author user stories and specs.
• Streamline risk triage and remediation pipelines; normalize and enrich datasets; monitor automation performance.
• Develop custom forms, dashboards, analytics, and handle platform issues with logging and performance tuning.
• Establish and maintain change controls and documentation for all SOAR automations.

Skills

SOAR platforms

RESTful APIs

Scripting (Python/PowerShell/JS)

Incident Response lifecycle

Security operations workflows

Stakeholder engagement

Dashboard development

Tools

Palo Alto Cortex XSOAR

Splunk SOAR

Microsoft Sentinel

Job description

Randstad is seeking an experienced SOAR Automation Engineer for a high-profile client engagement based in Washington, DC. In this dynamic hybrid role, you will serve as the technical bridge between security operations and automation engineering, designing and deploying automated workflows, custom playbooks, and API integrations across diverse enterprise systems. You will lead technical discovery sessions with stakeholders, translate complex business and security needs into precise technical requirements, and optimize risk triage and incident remediation processes. By building custom dashboards, normalizing datasets, and maintaining robust change controls, you will streamline SecOps capabilities while driving operational efficiency across cloud and on-premises environments.

Key Responsibilities

• Workflow & Integration Engineering: Design, build, and maintain automated playbooks, workflows, custom widgets, and API connectors across SaaS, cloud, and on-premises systems (including CMDBs, ticketing tools, and security platforms).
• Requirements & Stakeholder Engagement: Conduct technical discovery sessions with business and security stakeholders to gather requirements, identify process inefficiencies, and author clear user stories, epics, and technical specifications.
• Process & Risk Optimization: Streamline risk triage, escalation, and remediation pipelines; normalize and enrich security datasets; and continuously monitor automation performance for efficiency gains.
• Platform Operations & UI Development: Develop custom forms, user interfaces, dashboards, and analytics reporting while troubleshooting platform issues, managing application performance, and implementing robust error handling and logging.
• Governance & Compliance: Establish and maintain strict change controls, data validation standards, and documentation for all SOAR automations to support enterprise compliance initiatives.

Qualifications

• Technical Expertise: Proven hands-on experience building, testing, and deploying custom playbooks and integrations within leading SOAR platforms (e.g., Palo Alto Cortex XSOAR, Splunk SOAR, or Microsoft Sentinel).
• API & Systems Integration: Deep proficiency with RESTful APIs, JSON/XML parsing, scripting (Python, PowerShell, or JavaScript), and integrating hybrid environments (AWS, Azure, M365, ITSM platforms).
• Security & Process Domain Knowledge: Strong understanding of Incident Response lifecycle, threat mitigation, security operations workflows, and risk triage frameworks.
• Business Analysis Skills: Demonstrated ability to act as a hybrid technical analyst—translating non-technical stakeholder requests into structured requirements, acceptance criteria, and architecture docs.
• Soft Skills & Location: Strong written and verbal communication skills; local or regional proximity to the Washington, DC area for hybrid client onboarding and collaborative sessions.

Required Skills :

Basic Qualification :

Additional Skills :

Background Check : No

Drug Screen : No