Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Manager - Consulting
EY · Hartford, CT · 1 mo ago
Hybrid$174k–$290k/yrFull-time
We need to output HTML fragment with sections: About the role? The posting includes location line, then intro paragraphs, then "The Opportunity", then "Your Key Responsibilities", then "Skills And Attributes For Success", then "To Qualify for the Role, You Must Have", then "Ideally, You'll Also Have", then "What We Look For", then "What We Offer You". Also salary range and benefits.
We must not repeat job title as heading. Use for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We need to map content to these headings. The posting includes many sections; we need to decide which headings to include based on actual content.
We have:
- About the role: could be the introductory paragraphs after location: "At EY, we’re all in to shape your future with confidence..." plus "The Opportunity". Could combine as About the role.
- Responsibilities: "Your Key Responsibilities" list.
- Requirements / Qualifications: "To Qualify for the Role, You Must Have" plus maybe "Ideally, You'll Also Have" could be Qualifications or Skills. The instruction: Use headings for Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which to include.
We have skills and attributes: "Skills And Attributes For Success". That's Skills.
We have qualifications: "To Qualify for the Role, You Must Have" (mandatory) and "Ideally, You'll Also Have" (preferred). Could combine into Qualifications.
We have Benefits: "What We Offer You" includes medical, dental, pension, 401(k), paid time off. Also mention "Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options." So Benefits section.
Pay: salary ranges given. So Pay section.
Schedule: Not mentioned. No schedule info. So we should NOT include Schedule heading.
We should not include headings with filler. So include About the role, Responsibilities, Qualifications, Skills, Benefits, Pay.
We need to preserve all substantive information, not invent or summarize away detail. Must not omit details. Must include all content from those sections.
We need to format lists with
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We need to map content to these headings. The posting includes many sections; we need to decide which headings to include based on actual content.
We have:
- About the role: could be the introductory paragraphs after location: "At EY, we’re all in to shape your future with confidence..." plus "The Opportunity". Could combine as About the role.
- Responsibilities: "Your Key Responsibilities" list.
- Requirements / Qualifications: "To Qualify for the Role, You Must Have" plus maybe "Ideally, You'll Also Have" could be Qualifications or Skills. The instruction: Use headings for Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which to include.
We have skills and attributes: "Skills And Attributes For Success". That's Skills.
We have qualifications: "To Qualify for the Role, You Must Have" (mandatory) and "Ideally, You'll Also Have" (preferred). Could combine into Qualifications.
We have Benefits: "What We Offer You" includes medical, dental, pension, 401(k), paid time off. Also mention "Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options." So Benefits section.
Pay: salary ranges given. So Pay section.
Schedule: Not mentioned. No schedule info. So we should NOT include Schedule heading.
We should not include headings with filler. So include About the role, Responsibilities, Qualifications, Skills, Benefits, Pay.
We need to preserve all substantive information, not invent or summarize away detail. Must not omit details. Must include all content from those sections.
We need to format lists with - . For prose use
. For headings use
.
We must not include boilerplate like EEO, legal, application instructions, cookie/navigation, etc. Remove duplicated lines.
We need to include location? The location line: "Location: Anywhere in Country". Might be considered metadata; we can fold into a short
or drop. Probably include as a short paragraph under About the role? The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. So we can include location as a short
maybe before sections.
We must not repeat job title as heading.
We need to output only HTML fragment.
Let's extract content.
First, location line: "Location: Anywhere in Country". We'll make a
Location: Anywhere in Country
.
Then introductory paragraphs: "At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world." Then "The Opportunity" paragraph(s). Let's capture that.
The Opportunity paragraph: "In a rapidly evolving cybersecurity landscape, organizations face increasingly sophisticated threats while managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a SOAR Engineering Manager, where you will lead the design, delivery, and optimization of security automation solutions that help organizations respond to threats faster and more effectively. You will combine technical leadership, client advisory, delivery management, and team development to guide complex SOAR initiatives. Working with security operations, incident response, threat detection, engineering, and business stakeholders, you will shape automation strategies, oversee platform implementations, and help clients realize measurable value from their cybersecurity investments."
We can combine these into About the role section.
Now Responsibilities: list of items after "Your Key Responsibilities". Each ends with a period. We'll make - each.
List:
- Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition.
- Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve Security Operations Center (SOC) effectiveness.
- Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring designs are scalable, secure, maintainable, and aligned with client requirements.
- Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting activities.
- Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
- Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities.
- Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans.
- Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction.
- Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions.
- Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment.
- Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice.
- Maintain awareness of emerging threats, AI-assisted security operations, automation technologies, cloud-native security capabilities, and evolving SOAR platforms.
Now Qualifications: "To Qualify for the Role, You Must Have" list.
We need to capture all bullet-like sentences. It's a paragraph with semicolons? Actually it's a list separated by line breaks? In text it's sentences separated by periods. We'll treat each sentence as a bullet.
List:
- A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, and 6-10 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
- Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments.
- Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable technologies.
- Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
- Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
- Strong knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.
- Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms.
- Understanding of infrastructure, networking, operating systems, and major cloud platforms, including Microsoft Azure, Amazon Web Services, and Google Cloud Platform.
- Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production environments.
- Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards.
- Ability to lead client-facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders.
- Relevant industry or platform certifications, or the ability to obtain an applicable certification after employment.
Now "Ideally, You'll Also Have" list (preferred qualifications). We'll include under Qualifications as additional bullets maybe under a subheading? But we only have Qualifications heading; we can include both mandatory and preferred under same list, maybe differentiate with text? But we must preserve all info. Could add a
Preferred qualifications:
then list. Or we could include them as part of Qualifications list. Since we cannot invent headings, we can just add a paragraph before the list: "Preferred qualifications:
" then list.
Preferred list:
- Experience architecting enterprise-scale SOAR implementations and establishing security automation programs or centers of enablement.
- Experience developing reusable automation frameworks, advanced orchestration solutions, and platform governance standards.
- Familiarity with Infrastructure as Code technologies such as Terraform, ARM templates, Bicep, or CloudFormation.
- Experience with DevSecOps, CI/CD pipelines, cloud-native automation, containers, and serverless technologies.
- Experience defining automation use-case portfolios, prioritization criteria, value metrics, and adoption roadmaps.
- Ability to translate operational requirements into target-state architectures, implementation roadmaps, estimates, and business cases.
- Experience with consulting engagement methodologies, proposal development, statements of work, and executive-level presentations.
- Familiarity with AI-assisted security operations, generative AI use cases, and responsible automation controls.
Now Skills: "Skills And Attributes For Success" list.
List:
- Strong leadership, structured problem-solving, and critical-thinking skills, with the ability to make sound decisions in complex client environments.
- Deep knowledge of security operations and demonstrated ability to connect business objectives, operating processes, and technical architecture.
- Ability to lead concurrent workstreams, manage ambiguity, prioritize effectively, and drive accountability across cross-functional teams.
- Executive presence and strong written and verbal communication skills, including the ability to influence technical and non-technical stakeholders.
- Demonstrated ability to design scalable integrations and automation solutions across complex enterprise environments.
- Experience developing high-quality client deliverables, architecture documents, roadmaps, reports, proposals, and presentations.
- Commercial awareness, including scope management, estimation, resource planning, risk management, and engagement economics.
- Commitment to quality, continuous improvement, mentorship, and inclusive team leadership.
Now Benefits: "What We Offer You" paragraph.
Paragraph: "At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: ..." Actually salary is separate; we need to separate Pay.
Benefits: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options.
We should capture the Benefits paragraph: "In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options."
Also earlier: "Learn more at ey.com/us/careers." That's more like a link; could be part of Benefits or About the role? It's about learning more; we can keep as a short paragraph maybe under Benefits or About the role. Since it's not a benefit, maybe we keep it under About the role? But it's part of "What We Offer You". Actually the section "What We Offer You" includes: "At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: ... In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options."
Thus we need to split: Benefits: professional growth, personal fulfillment, inclusive culture, medical/dental, pension/401(k), paid time off. Also maybe "Learn more at ey.com/us/careers." is a call to action; could be part of Benefits or separate. We'll include it as a paragraph under Benefits.
Pay: salary ranges.
We need to extract salary ranges exactly:
"The salary range for this job is:New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $173,9
. For headings use
. We must not include boilerplate like EEO, legal, application instructions, cookie/navigation, etc. Remove duplicated lines. We need to include location? The location line: "Location: Anywhere in Country". Might be considered metadata; we can fold into a short
or drop. Probably include as a short paragraph under About the role? The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. So we can include location as a short
maybe before sections. We must not repeat job title as heading. We need to output only HTML fragment. Let's extract content. First, location line: "Location: Anywhere in Country". We'll make a
Location: Anywhere in Country
. Then introductory paragraphs: "At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world." Then "The Opportunity" paragraph(s). Let's capture that. The Opportunity paragraph: "In a rapidly evolving cybersecurity landscape, organizations face increasingly sophisticated threats while managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a SOAR Engineering Manager, where you will lead the design, delivery, and optimization of security automation solutions that help organizations respond to threats faster and more effectively. You will combine technical leadership, client advisory, delivery management, and team development to guide complex SOAR initiatives. Working with security operations, incident response, threat detection, engineering, and business stakeholders, you will shape automation strategies, oversee platform implementations, and help clients realize measurable value from their cybersecurity investments." We can combine these into About the role section. Now Responsibilities: list of items after "Your Key Responsibilities". Each ends with a period. We'll make- each.
List:
- Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition.
- Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve Security Operations Center (SOC) effectiveness.
- Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring designs are scalable, secure, maintainable, and aligned with client requirements.
- Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting activities.
- Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms.
- Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities.
- Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans.
- Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction.
- Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions.
- Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment.
- Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice.
- Maintain awareness of emerging threats, AI-assisted security operations, automation technologies, cloud-native security capabilities, and evolving SOAR platforms.
Now Qualifications: "To Qualify for the Role, You Must Have" list.
We need to capture all bullet-like sentences. It's a paragraph with semicolons? Actually it's a list separated by line breaks? In text it's sentences separated by periods. We'll treat each sentence as a bullet.
List:
- A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, and 6-10 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
- Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments.
- Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable technologies.
- Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages.
- Experience designing and consuming REST APIs, web services, SDKs, and custom integrations.
- Strong knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management.
- Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms.
- Understanding of infrastructure, networking, operating systems, and major cloud platforms, including Microsoft Azure, Amazon Web Services, and Google Cloud Platform.
- Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production environments.
- Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards.
- Ability to lead client-facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders.
- Relevant industry or platform certifications, or the ability to obtain an applicable certification after employment.
Now "Ideally, You'll Also Have" list (preferred qualifications). We'll include under Qualifications as additional bullets maybe under a subheading? But we only have Qualifications heading; we can include both mandatory and preferred under same list, maybe differentiate with text? But we must preserve all info. Could add a
Preferred qualifications:
then list. Or we could include them as part of Qualifications list. Since we cannot invent headings, we can just add a paragraph before the list: "Preferred qualifications:
" then list. Preferred list: - Experience architecting enterprise-scale SOAR implementations and establishing security automation programs or centers of enablement. - Experience developing reusable automation frameworks, advanced orchestration solutions, and platform governance standards. - Familiarity with Infrastructure as Code technologies such as Terraform, ARM templates, Bicep, or CloudFormation. - Experience with DevSecOps, CI/CD pipelines, cloud-native automation, containers, and serverless technologies. - Experience defining automation use-case portfolios, prioritization criteria, value metrics, and adoption roadmaps. - Ability to translate operational requirements into target-state architectures, implementation roadmaps, estimates, and business cases. - Experience with consulting engagement methodologies, proposal development, statements of work, and executive-level presentations. - Familiarity with AI-assisted security operations, generative AI use cases, and responsible automation controls. Now Skills: "Skills And Attributes For Success" list. List: - Strong leadership, structured problem-solving, and critical-thinking skills, with the ability to make sound decisions in complex client environments. - Deep knowledge of security operations and demonstrated ability to connect business objectives, operating processes, and technical architecture. - Ability to lead concurrent workstreams, manage ambiguity, prioritize effectively, and drive accountability across cross-functional teams. - Executive presence and strong written and verbal communication skills, including the ability to influence technical and non-technical stakeholders. - Demonstrated ability to design scalable integrations and automation solutions across complex enterprise environments. - Experience developing high-quality client deliverables, architecture documents, roadmaps, reports, proposals, and presentations. - Commercial awareness, including scope management, estimation, resource planning, risk management, and engagement economics. - Commitment to quality, continuous improvement, mentorship, and inclusive team leadership. Now Benefits: "What We Offer You" paragraph. Paragraph: "At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: ..." Actually salary is separate; we need to separate Pay. Benefits: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options. We should capture the Benefits paragraph: "In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options." Also earlier: "Learn more at ey.com/us/careers." That's more like a link; could be part of Benefits or About the role? It's about learning more; we can keep as a short paragraph maybe under Benefits or About the role. Since it's not a benefit, maybe we keep it under About the role? But it's part of "What We Offer You". Actually the section "What We Offer You" includes: "At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: ... In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options." Thus we need to split: Benefits: professional growth, personal fulfillment, inclusive culture, medical/dental, pension/401(k), paid time off. Also maybe "Learn more at ey.com/us/careers." is a call to action; could be part of Benefits or separate. We'll include it as a paragraph under Benefits. Pay: salary ranges. We need to extract salary ranges exactly: "The salary range for this job is:New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $173,9