SOAR Engineering Lead: Security Automation & Orchestration

EY

Detroit (MI)

Remote

USD 145,000 - 290,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

EY is seeking a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions. You will guide automation strategies, oversee platform implementations, and help clients realize measurable value from cybersecurity investments.

In this role, you will manage end-to-end SOAR engagements, align with SOC processes, and lead cross-functional teams to deliver scalable, secure automation capabilities within enterprise environments.

Qualifications

A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, MIS, or related field with 6–10 years of experience in security automation or SOAR.
Experience leading teams or workstreams for design and delivery of security automation or SOAR solutions in enterprise environments.
Hands-on experience with enterprise SOAR platforms such as Cortex XSOAR, Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3, or Swimlane.
Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
Strong knowledge of SOC processes including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.
Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms.
Understanding of infrastructure, networking, OS, and major cloud platforms (Azure, AWS, GCP).
Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production.
Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards.
Ability to lead client-facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders.
Relevant industry or platform certifications, or ability to obtain an applicable certification after employment.

Responsibilities

Lead end-to-end SOAR and security automation engagements from discovery through deployment and transition.
Advise clients on automation strategy, operating models, governance, platform selection, and roadmaps.
Own solution architecture and delivery quality for enterprise SOAR implementations.
Direct design and development of playbooks for incident triage, enrichment, investigation, containment, remediation, and reporting.
Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intel, vulnerability mgmt, email security, network security, ticketing, and collaboration platforms.
Provide technical oversight for custom integrations, APIs, connectors, and reusable frameworks.
Facilitate executive briefings, architecture reviews, and workshops; translate findings into recommendations and plans.
Manage engagement scope, workplans, risks, dependencies, staffing, and financial performance.
Establish engineering standards, governance controls, testing practices, and production support models.
Lead, coach, and develop multidisciplinary teams; foster inclusive, collaborative environment.
Identify follow-on opportunities, contribute to proposals, and grow the security automation practice.
Maintain awareness of emerging threats, AI-assisted security operations, and evolving SOAR platforms.