SOAR Automation Engineer — Splunk & SOC Orchestration

Peraton; Tampa (FL); On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton seeks Automation Engineers at MacDill AFB to design, build, and maintain automation solutions for enterprise cyber defense, focusing on SOAR, Splunk, and Microsoft Sentinel.

You will reduce manual tasks for SOC analysts, develop API integrations, and collaborate with incident responders to automate triage, containment, and remediation.

This on-site role requires DoD clearance and DoD 8570 IAT II compliance; strong scripting in Python, PowerShell, and Bash is highly valued.

Qualifications

• DoD 8570 IAT II AND
• DoW TS/SCI clearance required
• Must be DoW8140 compliant under the Work Role Code 451

Responsibilities

• Design, develop, test, and deploy automated workflows to support cyber incident triage.
• Administer and engineer enterprise SOAR platforms, including upgrades.
• Develop API integrations to connect the SOAR platform with security tools and TIPs.
• Collaborate with incident responders, threat hunters, and cyber analysts to map SOPs.
• Write, maintain, and optimize Python, PowerShell, or Bash scripts for alerts and actions.
• Troubleshoot playbook execution, API integrations, and data ingestion issues.
• Work with the automation team to deploy enterprise automation solutions.
• Maintain documentation for code, architecture, and playbook logic.
• Provide technical guidance and training to SOC personnel.
• Design and maintain SIEM-SOAR integrations (Splunk, MS Sentinel).

Skills

Automation design

SOAR platforms

Python

PowerShell

Bash

Collaboration

Education

HS Diploma

AS/AA degree

BS/BA degree

MS/MA degree

PhD

Tools

Splunk

Microsoft Sentinel

APIs

Git

Cloud (AWS/Azure)

Job description

Peraton seeks Automation Engineers at MacDill AFB to design, build, and maintain automation solutions for enterprise cyber defense, focusing on SOAR, Splunk, and Microsoft Sentinel.

You will reduce manual tasks for SOC analysts, develop API integrations, and collaborate with incident responders to automate triage, containment, and remediation.

This on-site role requires DoD clearance and DoD 8570 IAT II compliance; strong scripting in Python, PowerShell, and Bash is highly valued.