Job summary

We are seeking a highly skilled SOAR engineer with deep expertise in security automation, orchestration, and cloud security. In this senior role, you will design, implement, and maintain security orchestration, automation, and response workflows to improve threat detection, incident response, and operational efficiency. The ideal candidate brings hands-on experience with one or more SOAR platforms (such as Splunk SOAR, Palo Alto XSOAR, Tines, or similar), and will leverage Python, APIs, and modern cloud and security technologies to integrate multiple tools, automate processes, and enhance visibility across the enterprise. Experience with Tines is a plus, though candidates with strong SOAR fundamentals and a track record of picking up new platforms quickly are strongly encouraged to apply.

You will be a hands-on technical leader, collaborating across teams to ensure scalable and resilient security operations while mentoring junior engineers and shaping the automation roadmap. Contribute to the strategic automation roadmap, evaluating new tools and approaches to improve security operations maturity.

What you will do

• Design, implement, and maintain SOAR workflows and playbooks to automate incident response and threat management processes.
• Develop, maintain, and optimize Python scripts and automation tools to enhance security operations and response times.
• Integrate and automate security tools such as CrowdStrike, RecordedFuture, and SIEM platforms like Splunk, providing actionable insights and improved response capabilities.
• Develop advanced Splunk queries, dashboards, and alerts to support threat hunting, incident investigations, and operational monitoring.
• Design and implement automation solutions in AWS, including enforcing security controls, monitoring compliance, and streamlining cloud operations.
• Perform advanced log analysis, data correlation, and anomaly detection to support proactive threat detection and investigations.

What you will have

• 5+ years of experience in security operations, SOAR engineering (Tines preferred), or security automation.
• Strong proficiency in Python and experience developing automation scripts or tools.
• Experience with AWS security and cloud automation.
• Experience integrating endpoint security tools (CrowdStrike) and threat intelligence platforms (RecordedFuture).
• Advanced knowledge of Splunk: SPL queries, dashboards, and visualizations.
• Experience building and troubleshooting RESTful APIs for internal or security applications.
• Excellent problem-solving, written, and verbal communication skills.
• Proven ability to mentor junior engineers and lead cross-functional automation projects.

Nice to have

• Exposure to cloud security posture management tools (e.g., Wiz CNAPP).
• Experience building lightweight internal web applications or APIs in Python (e.g., Flask or FastAPI).
• Master’s degree in a technical discipline.
• Familiarity with SASE products, WAFs, and cloud identity providers (SSO, SAML).
• Experience with security, compliance, and privacy frameworks (ISO 27001, NIST, GDPR, SOC2, WebTrust).

Benefits

• Generous time off policies
• Top shelf benefits
• Education, wellness and lifestyle support

To protect candidate information and maintain a secure hiring process, all applications must be submitted through our careers portal. Resumes or CVs sent directly via email will not be reviewed or considered.

#LI-SD1