SOAR Engineering Manager — Automate Security Operations

EY; Boca Raton (FL); On-site; USD 150,000 - 230,000; Full time

Job summary

EY is seeking a seasoned SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions across client environments. You will direct playbook development, orchestrate SIEM/EDR/IAM integrations, and guide security automation programs with senior stakeholders.

Join EY to shape automation strategies, drive measurable value from cybersecurity investments, and mentor diverse teams in a fast-paced consulting setting.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, MIS, or a related field, and 6-10 years of relevant experience.
• Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments.
• Hands-on experience with enterprise SOAR platforms such as Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane.
• Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
• Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
• Knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.
• Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms.
• Understanding of infrastructure, networking, operating systems, and major cloud platforms, including Azure, AWS, and GCP.
• Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production environments.
• Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards.
• Ability to lead client-facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders.
• Relevant industry or platform certifications, or the ability to obtain an applicable certification after employment.

Responsibilities

• Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition.
• Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve Security Operations Center (SOC) effectiveness.
• Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring designs are scalable, secure, maintainable, and aligned with client requirements.
• Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting activities.
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
• Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities.
• Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans.
• Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction.
• Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions.
• Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment.
• Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice.
• Maintain awareness of emerging threats, AI-assisted security operations, automation technologies, cloud-native security capabilities, and evolving SOAR platforms.

Skills

Leadership

Problem-solving

Critical thinking

Security operations knowledge

Concurrent workstreams

Executive communication

Technical architecture

Client deliverables

Commercial awareness

Quality & mentorship

Inclusive leadership

Education

Bachelor's degree in Computer Science / Computer Engineering / Cybersecurity / Information Technology / MIS or related field

Tools

Palo Alto Cortex XSOAR

Microsoft Sentinel Automation

Splunk SOAR

Google Security Operations

Tines

D3 Security

Swimlane

Job description

EY is seeking a seasoned SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions across client environments. You will direct playbook development, orchestrate SIEM/EDR/IAM integrations, and guide security automation programs with senior stakeholders.

Join EY to shape automation strategies, drive measurable value from cybersecurity investments, and mentor diverse teams in a fast-paced consulting setting.