SOAR Engineer

Global Enterprise Services, Llc; San Antonio (TX); On-site; USD 75,000 - 125,000; Full time

Job summary

Global Enterprise Services, Llc in San Antonio, TX, seeks an experienced SOAR Engineer to support the government customer’s SOAR platform and its integration with Elastic SIEM. The role covers sustainment, monitoring, and content development for the XSOAR platform and its connections to SIEM, hosted on AF Cloud One.

The position requires on-site presence at Joint Base San Antonio and an active TS/SCI clearance.

Qualifications

• Experience with SOAR and SIEM integrations.
• Developing and maintaining automation playbooks.
• Knowledge of Tanium, Defender, Patriot, or similar security platforms.
• Ability to build connectors between SOAR and third-party systems.

Responsibilities

• Support SOAR-SIEM integration and triage alerts.
• Create integrations with USAF systems as directed.
• Identify data sources and establish connectors.
• Design playbooks with content developers to reduce workload.
• Monitor cluster health and performance; troubleshoot issues.
• Validate dashboards for accuracy and availability.
• Incorporate analyst feedback to improve playbooks and workflows.

Skills

SOAR platforms

XSOAR integration

SIEM integration

Automation playbooks

Education

Bachelor's degree

Tools

XSOAR

Elastic SIEM

Tanium

Defender

Patriot

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time San Antonio, TX, US

24 days ago Requisition ID: 1388

Salary Range: $75,000.00 To $125,000.00 Annually

Location:

Clearance Required:

TS/SCI

Position Summary

The Digital Modernization Sector has an exciting career opportunity for an experienced SOAR Engineer to support the government customer's Security Orchestration, Automation, and Response (SOAR) platform and its integration with the Global Security Information and Event Management (SIEM) environment. This position is responsible for the sustainment, monitoring, and content development of the Global SOAR platform-Currenly Palo Alto XSOAR and its connection to the Global SIEM - Currenly Elastic SIEM. This application is hosted on AF Cloud one on both NIPRNET and SIPRNET. The SOAR Engineer works closely with government stakeholders, the 33rd Content Developers, and mission partners to build automation, integrations, and playbooks that improve analyst efficiency and reduce response time.

The position requires on-site presence at Joint Base San Antonio supporting the USAF Defensive Cyber Systems Program Management Office’s Product Section. This position is regularly in a cleared facility to maintain classified applications.

3. Government-Directed Responsibilities

Key Responsibilities

• Support further integration of the Global SIEM with the Global SOAR platform so that SOAR can receive and triage SIEM-generated alerts.
• Establish new integrations with United States Air Force (USAF) systems such as Tanium, Defender, Patriot, and other mission-relevant platforms as directed.
• Work with the SIEM team toidentifyvendor system data sources being ingested andestablishconnectivity using similar connectors where operationally relevant.
• Content Creation - Partner with the 33rd Content Developers to design and build playbooks that reduce analyst workload and save analyst time.
• Monitor SOAR cluster health and detection rule performance, identifying and remediating issues that affect orchestration, automation, or alerting.
• Validate dashboards to ensure accuracy, availability, and relevance of reporting to end users.
• Collect and incorporate analyst feedback to drive continuous improvement of SOAR playbooks, dashboards, and workflows.

Required Qualifications

• Working knowledge of SOAR platforms (e.g., XSOAR/Cortex XSOAR) and their integration with SIEM platforms (e.g.,Elastic SIEM).
• Experience developing, testing, andmaintainingautomation playbooks in a SOAR environmentusing Palo Alto XSOAR.
• Familiarity with cybersecurity tools and data sources such as Tanium, Microsoft Defender, and Patriot, or comparable enterprise security platforms.
• Ability tobuild andtroubleshoot connectors/integrations between SOAR and third-party vendor systems.
• Ability to analyze detectionruleand cluster health data and troubleshoot orchestration or performance issues.
• Ability to manage applications hosted on a Cloud.
• Strong collaboration skills to work across content development,analyst, and government stakeholder teams.
• Effective written and verbal communication skills, including the ability to translate analyst feedback into actionable engineering improvements.

Preferred Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or related field, or equivalent experience]
• Familiarity withSOAR/SIEM or cybersecurity operations experience
• Prior experience supporting government or DoD security operations environments.'
• Familiarity with running applications on Air Force Cloud one

This position requires an active Top Secret clearance and may involve work in a cleared facility environment. Specific location and on-site requirements will be confirmed during the interview process.