Senior Cyber Security Engineer (SOAR)

Role Summary

The Senior Security Engineer – SOAR (G3) is responsible for developing, enhancing, and operationalizing security automation and orchestration workflows across the enterprise. This role supports and expands the organization’s SOAR capabilities through hands on engineering in Swimlane, Splunk Phantom, and Microsoft Logic Apps, helping automate repetitive SOC tasks, accelerate incident response, and improve consistency and efficiency across security operations.

Working under the guidance of the G4 Lead Engineer, the Senior Engineer builds and maintains automation playbooks, integrates security tools, supports API-based orchestration, and collaborates closely with SOC, IR, Cloud, Identity, and Network teams to identify automation opportunities. The role contributes to the SOAR roadmap, ensures reliable operation of automation pipelines, and mentors’ junior staff on automation principles and best practices.

Duties & Responsibilities

• Develop and maintain SOAR playbooks, integrations, and automations using Microsoft Sentinel Logic Apps.
• Build API-driven workflows that integrate SIEM (Microsoft Sentinel), EDR (Microsoft Defender for Endpoints), NDR, identity, cloud, network, threat intelligence, and ticketing systems into end to end automated processes.
• Support the onboarding of new automation use cases, including requirements gathering, workflow design, testing, and deployment into production.
• Enhance and tune existing automations to reduce manual analyst workload, ensure reliability, and improve error handling and orchestration efficiency.
• Troubleshoot automation failures, integration issues, and platform errors, implementing durable fixes and improvements.
• Collaborate with SOC, IR, Threat Hunting, and Engineering teams to identify high value automation opportunities and translate them into actionable workflows.
• Develop enrichment, triage, containment, and remediation automations that accelerate incident response and improve consistency.
• Maintain updated documentation for playbooks, workflows, connectors, authentication models, and operational runbooks.
• Monitor SOAR platform health, performance, and workflow success rates, making recommendations to improve stability and scalability.
• Mentor junior analysts and engineers on automation development, platform capabilities, and best practices for SOAR operations.

Requirements

Minimum Years of Experience: 4-7 years

Minimum of 4 years of experience in a cybersecurity role, with a proven track record of success.

Basic Qualifications

• Proficient in various cybersecurity frameworks and standards.
• Experience with security tools such as SIEM, firewalls, and intrusion detection systems.

Preferred Qualifications

• Relevant certifications (e.g., CISSP, CISM, CEH).
• Master’s degree in Cybersecurity or related field.