SOAR & Cyber Automation Engineer Lead

Ernst & Young Oman

Little Rock (AR)

Remote

USD 174,000 - 302,000

Full time

14 days+

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off

Job summary

EY is seeking a SOAR Engineering Manager to lead design, delivery and optimization of security automation solutions. You will guide cross-functional teams, shape automation strategies, and oversee platform implementations to deliver measurable cyber resilience for clients.

Role emphasizes architecture, client advisory, and production governance across SIEM, EDR/XDR, IAM, cloud security, and threat intelligence.

Qualifications

A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, MIS, or related field, and 6-10 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments.
Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable technologies.
Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
Strong knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.
Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms.
Understanding of infrastructure, networking, operating systems, and major cloud platforms, including Microsoft Azure, Amazon Web Services, and Google Cloud Platform.
Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production environments.
Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards.
Ability to lead client-facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders.
Relevant industry or platform certifications, or the ability to obtain an applicable certification after employment.

Responsibilities

Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition.
Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve SOC effectiveness.
Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring designs are scalable, secure, maintainable, and aligned with client requirements.
Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting activities.
Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities.
Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans.
Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction.
Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions.
Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment.
Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice.