SOAR & Cybersecurity Automation Lead

Ernst & Young Oman; Birmingham (AL); On-site; USD 145,000 - 302,000; Full time

Job summary

EY is seeking a SOAR Engineering Manager to lead design, delivery, and optimization of security automation solutions for diverse clients in the US. You will guide playbook development, architecture, and cross-functional delivery, coordinating with security operations, incident response, and engineering teams.

The role emphasizes leadership, client-facing communication, and the ability to translate complex findings into actionable plans, while growing the security automation practice.

Qualifications

• A bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, MIS, or related field.

Responsibilities

• Lead end-to-end SOAR and security automation engagements from discovery to transition.
• Own solution architecture and delivery quality for enterprise SOAR implementations.
• Direct the design and development of playbooks automating incident triage, enrichment, investigation, containment, remediation, case management, and reporting.
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
• Provide technical oversight for custom integrations, APIs, connectors, and cloud-native automation capabilities.
• Facilitate executive briefings and translate findings into clear recommendations.

Skills

Leadership

Security operations

Architecture

Client advisory

Delivery management

Team development

Executive communication

Education

Bachelor's degree in CS/CE/Cybersecurity

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a SOAR Engineering Manager to lead design, delivery, and optimization of security automation solutions for diverse clients in the US. You will guide playbook development, architecture, and cross-functional delivery, coordinating with security operations, incident response, and engineering teams.

The role emphasizes leadership, client-facing communication, and the ability to translate complex findings into actionable plans, while growing the security automation practice.