Splunk SOAR Automation Engineer - DoD SOC, TS/SCI

Peraton; Town of Florida, Northern (NY, KY); Hybrid; USD 104,000 - 166,000; Full time

Job summary

Peraton is seeking Automation Engineers to design, build, and maintain automation to support SOAR and SIEM/SOAR integration for USSOCOM SITEC 3 EOM. Based at MacDill AFB, you will reduce manual tasks and accelerate incident response by connecting security tools via APIs and scripting.

You will implement automated workflows, maintain SOAR platforms, create API connections with TIPs and ITSM, and mentor SOC staff on automation best practices.

Qualifications

• 8+ years in DoD/DoW environments or equivalent security operations.
• DoD 8570 IAT II AND
• DoW8140 compliant under code 451 – System Administrator - Intermediate or higher by 1 Sept 26.
• Experience with SIEM engineering and EDR/XDR technologies.

Responsibilities

• Design, build, test, and deploy automated workflows, playbooks, and scripts for cyber incident triage and remediation.
• Administer and engineer enterprise SOAR platforms, including health monitoring and upgrades.
• Develop custom API integrations to connect SOAR with security tools, TIPs, and ITSM systems.
• Collaborate with responders and analysts to gather requirements and translate SOPs into automated processes.
• Write and optimize scripts (Python, PowerShell, Bash) for parsing data and automating responses.
• Troubleshoot playbook execution, API integrations, and data ingestion bottlenecks.
• Maintain documentation for code, automation architecture, and playbooks.

Skills

CI/CD pipelines

DevOps practices

Git

Cloud-native automation

SOC/Threat detection

Education

HS Diploma

AS/AA degree

BS/BA degree

MS/MA degree

PhD

Tools

Splunk

Microsoft Sentinel

ITSM systems

Threat Intelligence Platforms (TIPs)

Git

AWS Lambda

Azure Logic Apps

Job description

Peraton is seeking Automation Engineers to design, build, and maintain automation to support SOAR and SIEM/SOAR integration for USSOCOM SITEC 3 EOM. Based at MacDill AFB, you will reduce manual tasks and accelerate incident response by connecting security tools via APIs and scripting.

You will implement automated workflows, maintain SOAR platforms, create API connections with TIPs and ITSM, and mentor SOC staff on automation best practices.