SOAR Engineering Manager: Security Automation & Playbooks

EY; Cleveland (OH); On-site; USD 145,000 - 266,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions. You will guide automation strategies, oversee platform implementations, and help clients realize value from cybersecurity investments.

You will work with security operations, incident response, threat detection, engineering, and business stakeholders to shape automation roadmaps, ensure scalable architectures, and deliver measurable outcomes for complex SOC environments.

Qualifications

• Bachelor's degree in Computer Science or related field with 6–10 years in security automation/SOAR engineering.
• Experience leading teams delivering security automation or SOAR solutions in enterprise environments.
• Hands-on with enterprise SOAR platforms (XSOAR, Splunk SOAR, Sentinel Automation, etc.).
• Strong software development and scripting experience (Python, PowerShell, JavaScript).
• Experience designing/rest APIs, web services, SDKs, and custom integrations.
• Knowledge of SOC processes: alert triage, incident response, threat detection, vulnerability management, case management.
• Experience integrating security tech across SIEM, EDR/XDR, IAM, cloud, email, network, ticketing, collaboration.
• Understanding of cloud platforms (Azure, AWS, GCP) and infrastructure concepts.
• Ability to lead client-facing engagements, manage risks, and communicate to senior stakeholders.
• Certifications or ability to obtain relevant security certifications.

Responsibilities

• Lead end-to-end SOAR engagements from discovery through architecture, implementation, testing, deployment, and transition.
• Advise clients on automation strategy, governance, platform selection, and SOC effectiveness.
• Own solution architecture and delivery quality for enterprise SOAR implementations.
• Design and develop playbooks for incident triage, enrichment, investigation, remediation, and reporting.
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intel, and collaboration platforms.
• Provide oversight for custom integrations, APIs, connectors, and reusable automation frameworks.
• Facilitate architecture reviews, stakeholder interviews, and requirements sessions; translate findings into plans.
• Manage engagement scope, workplans, risks, staffing, and delivery milestones; ensure client satisfaction.
• Establish engineering standards, governance controls, testing practices, and production support models.

Skills

SOAR platforms

Security operations leadership

Automation scripting

REST APIs & integrations

Cloud platforms

Incident response

Executive communication

Client-facing delivery

Project governance

Security architecture

Education

Bachelor's degree in CS/related field

Tools

Palo Alto Cortex XSOAR

Splunk SOAR

Microsoft Sentinel Automation

Tines

D3 Security

Swimlane

Job description

EY is seeking a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions. You will guide automation strategies, oversee platform implementations, and help clients realize value from cybersecurity investments.

You will work with security operations, incident response, threat detection, engineering, and business stakeholders to shape automation roadmaps, ensure scalable architectures, and deliver measurable outcomes for complex SOC environments.