Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Manager - Consulting

We need to output HTML fragment with sections: About the role? The posting includes paragraphs: location line, then "At EY, we’re all in..." then "The Opportunity" paragraph, then "Your Key Responsibilities" list, then "Skills And Attributes For Success" list, then "To Qualify for the Role, You Must Have" list, then "Ideally, You'll Also Have" list, then "What We Look For" paragraph, then "What We Offer You At EY..." includes salary range and benefits, then other boilerplate to remove (EEO, legal, etc). We must not repeat job title as heading. Use

for section headings: e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which sections to include based on content. We have: - About the role: maybe the introductory paragraph after location? Could be "At EY, we’re all in..." and "The Opportunity". Could combine as About the role. - Responsibilities: "Your Key Responsibilities" list. - Requirements / Qualifications: "To Qualify for the Role, You Must Have" list (qualifications). Also "Ideally, You'll Also Have" could be additional qualifications/preferred. - Skills: "Skills And Attributes For Success" list. - Benefits: "What We Offer You At EY..." includes benefits (medical, dental, pension, 401(k), paid time off). Also salary range is Pay. - Pay: salary range details. - Schedule: not mentioned; we should not create Schedule section. We must not include sections with placeholder or vague content. So include About the role, Responsibilities, Skills, Qualifications (maybe split into Required Qualifications and Preferred Qualifications?), Benefits, Pay. But the instruction: "Prefer a few substantive sections over many thin ones." Could combine Qualifications and Skills into one? But they have distinct headings allowed: Qualifications, Skills. We could have both. We need to use

for section headings. Use

• for any list of duties/requirements/benefits, and

  for prose. We must not repeat job title as heading. No Job ID etc. We must preserve ALL substantive information; do not invent or summarize away detail. So we need to keep all bullet points exactly as given? Probably we can keep the text but not summarizing. We'll need to copy the bullet points. We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So remove lines like "Are you ready to shape your future with confidence? Apply today." etc. Also remove "To make the most of your application experience..." etc. Also remove EEO statement at end. Also remove "EY | Building a better working world" etc. Also remove "EY provides equal employment opportunities..." etc. Also remove accommodation info. Also remove "Any misrepresentation..." etc. We need to keep the salary range and benefits description. Let's extract substantive content: Location line: "Location: Anywhere in Country". Might be considered metadata; we could fold into a short

  or drop it. Probably we can include as a short paragraph. Then: "At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world." Then: "The Opportunity In a rapidly evolving cybersecurity landscape, organizations face increasingly sophisticated threats while managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a SOAR Engineering Manager, where you will lead the design, delivery, and optimization of security automation solutions that help organizations respond to threats faster and more effectively. You will combine technical leadership, client advisory, delivery management, and team development to guide complex SOAR initiatives. Working with security operations, incident response, threat detection, engineering, and business stakeholders, you will shape automation strategies, oversee platform implementations, and help clients realize measurable value from their cybersecurity investments." Then "Your Key Responsibilities" followed by a list of responsibilities (each sentence ends with a period). We'll need to put each as

• . Then "Skills And Attributes For Success" list. Then "To Qualify for the Role, You Must Have" list. Then "Ideally, You'll Also Have" list. Then "What We Look For" paragraph. Then "What We Offer You At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $173,900 to $290,100 Bay Area California offices – $181,200 to $302,100 All other offices locations in the US, including Sacramento – $144,900 to $265,800 Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options." We should keep that as Benefits and Pay sections. We need to decide headings: About the role (maybe combine first two paragraphs), Responsibilities, Skills, Qualifications (maybe combine Required and Preferred?), Benefits, Pay. But we have separate lists for Required Qualifications and Preferred Qualifications. Could combine under Qualifications with two sub-sections? But we only allowed headings from list; we could still have

  Qualifications

  and then within that have two
  maybe with a

  indicating required vs preferred. However we must not invent filler. Could just have one Qualifications section containing both lists, but we need to differentiate? Could put a

  before each list: "Required qualifications:" and "Preferred qualifications:" as prose. That's acceptable. Similarly Skills section. Benefits: we have benefits description (medical, dental, pension, 401(k), paid time off). Could be a

  list. Pay: salary range details. We must not include Schedule. Now produce HTML fragment. Let's craft:

  About the role

  Location: Anywhere in Country

  At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.

  The Opportunity In a rapidly evolving cybersecurity landscape, organizations face increasingly sophisticated threats while managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a SOAR Engineering Manager, where you will lead the design, delivery, and optimization of security automation solutions that help organizations respond to threats faster and more effectively. You will combine technical leadership, client advisory, delivery management, and team development to guide complex SOAR initiatives. Working with security operations, incident response, threat detection, engineering, and business stakeholders, you will shape automation strategies, oversee platform implementations, and help clients realize measurable value from their cybersecurity investments.

  Responsibilities

  • Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition.
  • Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve Security Operations Center (SOC) effectiveness.
  • Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring designs are scalable, secure, maintainable, and aligned with client requirements.
  • Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting activities.
  • Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
  • Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities.
  • Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans.
  • Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction.
  • Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions.
  • Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment.
  • Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice.
  • Maintain awareness of emerging threats, AI-assisted security operations, automation technologies, cloud-native security capabilities, and evolving SOAR platforms.

  Skills

  • Strong leadership, structured problem-solving, and critical-thinking skills, with the ability to make sound decisions in complex client environments.
  • Deep knowledge of security operations and demonstrated ability to connect business objectives, operating processes, and technical architecture.
  • Ability to lead concurrent workstreams, manage ambiguity, prioritize effectively, and drive accountability across cross-functional teams.
  • Executive presence and strong written and verbal communication skills, including the ability to influence technical and non-technical stakeholders.
  • Demonstrated ability to design scalable integrations and automation solutions across complex enterprise environments.
  • Experience developing high-quality client deliverables, architecture documents, roadmaps, reports, proposals, and presentations.
  • Commercial awareness, including scope management, estimation, resource planning, risk management, and engagement economics.
  • Commitment to quality, continuous improvement, mentorship, and inclusive team leadership.

  Qualifications

  Required qualifications:

  • A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, and 6-10 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
  • Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments.
  • Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable technologies.
  • Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
  • Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
  • Strong knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.
  • Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms.
  • Understanding of infrastructure, networking, operating systems, and major cloud platforms, including Microsoft Azure, Amazon Web Services, and Google Cloud Platform.
  • Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production environments.
  • Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards.