Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Senior - Consulting
Ernst and Young22 hours ago
Base Salary
$105k - $219k/yr
Responsibilities
- Design, develop, and maintain automated security workflows and SOAR playbooks for triage, enrichment, containment, remediation, and reporting.
- Implement and optimize SOAR platforms by integrating security tools, data sources, operational processes, APIs, web services, SDKs, and custom connectors.
- Collaborate with SOC, incident response, threat intelligence, detection engineering, and vulnerability management teams to identify automation opportunities.
- Support SOAR platform deployments, upgrades, troubleshooting, and operational enhancements in production environments.
- Develop reusable automation frameworks, standards, technical documentation, client reports, and presentations.
- Mentor junior team members and provide technical leadership on security automation initiatives.
- Stay current with cybersecurity threats, cloud-native security capabilities, automation technologies, and SOAR solutions.
Requirements
- Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, plus 2–4 years of relevant experience.
- Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or similar technologies.
- Strong software development and scripting experience with Python, PowerShell, JavaScript, or comparable automation-focused languages.
- Experience developing and consuming APIs, web services, SDKs, and custom integrations.
- Knowledge of alert triage, incident response, threat detection, vulnerability management, and case management workflows.
- Experience integrating SIEM, EDR/XDR, IAM, email security, network security, cloud security, vulnerability management, threat intelligence, and ticketing platforms.
- Understanding of infrastructure, networking, operating systems, and Microsoft Azure, Amazon Web Services, and Google Cloud Platform environments.
- Experience designing, testing, troubleshooting, and maintaining production automation workflows.
- Knowledge of secure development principles, version control, testing methodologies, and CI/CD concepts.
- Relevant certifications such as Microsoft Certified: Cybersecurity Architect Expert, Microsoft SC-200, Splunk Core Certified Power User, Security+, CySA+, GSEC, GCIH, or Cortex XSOAR Engineer are preferred or may be acquired after employment.
- Preferred experience includes enterprise-scale SOAR implementations, custom integrations, reusable automation frameworks, Terraform, ARM templates, Bicep, CloudFormation, DevSecOps, CI/CD pipelines, cloud-native automation, and consulting engagement methodologies.
Benefits
- Medical and dental coverage.
- Pension and 401(k) plans.
- A wide range of paid time off options.
- Professional growth opportunities and an inclusive culture.
- The position is available anywhere in the country, with salary ranges varying by US location.
Tech Stack
Categories
About Ernst and Young
Ernst & Young (EY) provides audit/assurance, tax, consulting, strategy and transactions services to enterprises, financial institutions, and public‑sector clients. Structured as a global network of partner‑owned member firms, it sells professional services on a fee basis, including a dedicated Financial Services Organization for banking, insurance, and capital markets. Headquartered in London, EY was formed in 1989 from the merger of Ernst & Whinney and Arthur Young, and operates in 150+ countries.