SOAR Engineering Lead: Automate & Elevate Cyber Ops

Ernst & Young Oman; Tucson (AZ); Remote; USD 145,000 - 266,000; Full time

Job summary

EY is seeking a highly experienced SOAR Engineering Manager to lead end-to-end security automation initiatives across diverse client environments. You will shape automation strategies, guide platform implementations, and deliver scalable, secure playbooks and integrations.

You will collaborate with SOC, incident response, threat intel, and engineering teams to ensure high-quality client outcomes and measurable value from cybersecurity investments.

Qualifications

• A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field.
• 6-10 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
• Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments.
• Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable technologies.
• Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
• Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
• Strong knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.

Responsibilities

• Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition.
• Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve SOC effectiveness.
• Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring scalable, secure, maintainable designs.
• Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting.
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
• Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities.
• Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans.
• Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction.
• Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions.
• Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment.
• Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice.
• Maintain awareness of emerging threats, AI-assisted security operations, automation technologies, cloud-native security capabilities, and evolving SOAR platforms.

Skills

Leadership

Security operations

Architecture

Client advisory

Cross-functional

Education

Bachelor's degree in Computer Science / related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Google Security Operations

Tines

D3 Security

Swimlane

Job description

EY is seeking a highly experienced SOAR Engineering Manager to lead end-to-end security automation initiatives across diverse client environments. You will shape automation strategies, guide platform implementations, and deliver scalable, secure playbooks and integrations.

You will collaborate with SOC, incident response, threat intel, and engineering teams to ensure high-quality client outcomes and measurable value from cybersecurity investments.