SOAR Engineering Leader – Automate Cyber Defense at Scale

EY; Madison (WI); On-site; USD 145,000 - 266,000; Full time

Benefits offered by this job

Medical coverage (EY Total Rewards)

Pension and 401(k)

Paid time off

Job summary

EY is seeking a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions across client environments. You will guide architecture, playbook development, and cross-functional delivery with a focus on measurable security improvements.

You will work with security operations, incident response, threat detection, and engineering teams to shape automation strategies, oversee platform implementations, and drive value from cybersecurity investments.

Qualifications

• Bachelor's degree or higher in a related field and 6–10 years in security automation/SOAR engineering.
• Experience leading teams delivering security automation or SOAR solutions in enterprise environments.
• Hands-on with enterprise SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, Swimlane).
• Strong software development/scripting in Python, PowerShell, JavaScript, or similar.
• Experience designing/consuming REST APIs, web services, SDKs, and integrations.
• Solid knowledge of SOC processes: alert triage, incident response, threat detection, vulnerability management, case management.
• Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, cloud, and ticketing platforms.
• Understanding of cloud platforms (Azure/AWS/GCP) and network/infrastructure concepts.
• Ability to lead client-facing engagements and communicate recommendations to executives.
• Certifications or ability to obtain relevant security certifications.

Responsibilities

• Lead end-to-end SOAR and security automation engagements from discovery through deployment and transition.
• Advise clients on automation strategy, governance, platform selection, and SOC effectiveness.
• Own solution architecture and delivery quality for enterprise SOAR implementations.
• Design and develop playbooks for incident triage, investigation, containment, remediation, and reporting.
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, and collaboration tools.
• Provide technical oversight for custom integrations, APIs, connectors, and reusable frameworks.
• Translate findings into actionable recommendations and implementation plans for clients.
• Manage scope, risks, staffing, and milestones while ensuring service quality and client satisfaction.
• Establish engineering standards, governance, testing, and production support models.
• Lead and mentor multidisciplinary teams and foster an inclusive, collaborative environment.
• Identify follow-on opportunities, contribute to proposals, and grow the security automation practice.
• Maintain awareness of emerging threats and AI-assisted security operations.

Skills

Leadership

Security automation

SOAR engineering

Python/PowerShell/JavaScript

REST APIs

Client advisory

Delivery management

Architecture design

Stakeholder communication

Education

Bachelor's degree in CS/IS/Cybersecurity

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Tines

D3 Security

Swimlane

Job description

EY is seeking a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions across client environments. You will guide architecture, playbook development, and cross-functional delivery with a focus on measurable security improvements.

You will work with security operations, incident response, threat detection, and engineering teams to shape automation strategies, oversee platform implementations, and drive value from cybersecurity investments.