SOAR Engineer

Nowges; San Antonio, Northern (TX, KY); Hybrid; USD 75,000 - 125,000; Full time

Job summary

Nowges seeks an experienced SOAR Engineer to support the government customer’s SOAR platform and Elastic SIEM integration. The role covers sustainment, monitoring, and content development for the Global SOAR platform hosted on AF Cloud one (NIPRNET/SIPRNET).

The position requires on-site presence at Joint Base San Antonio to support the USAF Defensive Cyber Systems PMO Product Section, collaborating with stakeholders to build automation and playbooks that improve analyst efficiency and reduce

Qualifications

• Experience with SOAR platforms and SIEM integrations.
• Developing, testing, and maintaining automation playbooks in a SOAR environment.
• Ability to troubleshoot connectors/integrations with vendor systems.
• Experience in cloud-hosted apps and government or DoD security ops environments.

Responsibilities

• Support integration of Global SIEM with Global SOAR platform.
• Establish new integrations with USAF systems as directed.
• Identify data sources and establish connectivity using connectors.
• Design and build playbooks to reduce analyst workload.
• Monitor SOAR health and performance; validate dashboards.

Skills

SOAR engineering

XSOAR / Cortex XSOAR

SIEM integration

automation playbooks

team collaboration

Education

Bachelor's degree in CS / Cybersecurity / Info Systems

Tools

XSOAR

Elastic SIEM

Tanium

Microsoft Defender

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time

15 days ago Requisition ID: 1388

Salary Range: $75,000.00 To $125,000.00 Annually

Location:

Clearance Required:

TS/SCI

Position Summary

The Digital Modernization Sector has an exciting career opportunity for an experienced SOAR Engineer to support the government customer's Security Orchestration, Automation, and Response (SOAR) platform and its integration with the Global Security Information and Event Management (SIEM) environment. This position is responsible for the sustainment, monitoring, and content development of the Global SOAR platform–Currently Palo Alto XSOAR and its connection to the Global SIEM – Currently Elastic SIEM. This application is hosted on AF Cloud one on both NIPRNET and SIPRNET. The SOAR Engineer works closely with government stakeholders, the 33rd Content Developers, and mission partners to build automation, integrations, and playbooks that improve analyst efficiency and reduce response time.

The position requires on-site presence at Joint Base San Antonio supporting the USAF Defensive Cyber Systems Program Management Office’s Product Section. This position is regularly in a cleared facility to maintain classified applications.

3. Government-Directed Responsibilities

Key Responsibilities

• Support further integration of the Global SIEM with the Global SOAR platform so that SOAR can receive and triage SIEM-generated alerts.
• Establish new integrations with United States Air Force (USAF) systems such as Tanium, Defender, Patriot, and other mission-relevant platforms as directed.
• Work with the SIEM team toidentifyvendor system data sources being ingested andestablishconnectivity using similar connectors where operationally relevant.
• Content Creation — Partner with the 33rd Content Developers to design and build playbooks that reduce analyst workload and save analyst time.
• Monitor SOAR cluster health and detection rule performance, identifying and remediating issues that affect orchestration, automation, or alerting.
• Validate dashboards to ensure accuracy, availability, and relevance of reporting to end users.
• Collect and incorporate analyst feedback to drive continuous improvement of SOAR playbooks, dashboards, and workflows.

Required Qualifications

• Working knowledge of SOAR platforms (e.g., XSOAR/Cortex XSOAR) and their integration with SIEM platforms (e.g.,Elastic SIEM).
• Experience developing, testing, andmaintainingautomation playbooks in a SOAR environmentusing Palo Alto XSOAR.
• Familiarity with cybersecurity tools and data sources such as Tanium, Microsoft Defender, and Patriot, or comparable enterprise security platforms.
• Ability tobuild andtroubleshoot connectors/integrations between SOAR and third-party vendor systems.
• Ability to analyze detectionruleand cluster health data and troubleshoot orchestration or performance issues.
• Ability to manage applications hosted on a Cloud.
• Strong collaboration skills to work across content development,analyst, and government stakeholder teams.
• Effective written and verbal communication skills, including the ability to translate analyst feedback into actionable engineering improvements.

Preferred Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or related field, or equivalent experience]
• Familiarity withSOAR/SIEM or cybersecurity operations experience
• Prior experience supporting government or DoD security operations environments.’
• Familiarity with running applications on Air Force Cloud one

This position requires an active Top Secret clearance and may involve work in a cleared facility environment. Specific location and on-site requirements will be confirmed during the interview process.