Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Senior - Consulting

We need to output HTML fragment with sections: h3 headings for sections present: About the role? The posting includes "The Opportunity", "Your Key Responsibilities", "Skills And Attributes For Success", "To Qualify for the Role, You Must Have:", "Ideally, You'll Also Have", "What We Look For", "What We Offer You". Also location line maybe not needed. We need to preserve all substantive info, no boilerplate. Remove cookie/navigation/legal/EEO etc. Also remove application instructions like "Apply today", "limit yourself to two applications", etc. Also remove salary? Actually salary is substantive: they gave salary ranges. So we need a Pay section. Benefits: they mention Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. So Benefits section. Schedule: not mentioned. So omit Schedule. We need to not repeat job title as heading. The page already shows it, so we don't add heading for Senior SOAR Engineer. We need to use

for section headings. Use

• for any list of duties/requirements/benefits. Use

  for prose. We need to preserve all substantive info, not invent or summarize away detail. So we need to include details from each section. We need to remove duplicated lines, boilerplate. Let's extract content. First paragraph: "Location: Anywhere in Country At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world." This is generic intro; maybe we can include as About the role? Could be considered "About the role" or "About EY". The instruction: use h3 for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have About the role section with that intro. Then "The Opportunity" paragraph: talk about cybersecurity landscape, etc. Could be part of About the role or separate? Might be considered About the role as well. We'll combine into About the role. Then "Your Key Responsibilities" heading: we need Responsibilities section with list. Then "Skills And Attributes For Success": Skills section. Then "To Qualify for the Role, You Must Have:" => Requirements/Qualifications. Could be Qualifications section. Then "Ideally, You'll Also Have": maybe additional qualifications, could be part of Qualifications or Skills? Probably Qualifications (preferred). We'll include as Qualifications. Then "What We Look For": maybe also Qualifications or Skills? It's about top performers; could be Skills? But we already have Skills. Could be Qualifications. We'll treat as Qualifications (maybe as a subsection). But we need to avoid thin sections; we can combine. Then "What We Offer You": includes Benefits and Pay. So we need Benefits and Pay sections. We must not include boilerplate like "Learn more at ey.com/us/careers." That's maybe okay as part of About? It's a link; but it's not substantive? Might be considered navigation? Probably remove. Also remove "Are you ready to shape your future with confidence? Apply today." etc. Also remove "To make the most of your application experience..." etc. Also remove EEO statements at end. Now construct HTML. We'll have:

  About the role

  At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. In a rapidly evolving cybersecurity landscape, organizations are facing increasingly sophisticated threats while simultaneously managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a Senior SOAR Engineer, where you'll play a key role in designing, implementing, and optimizing security automation solutions that enable organizations to respond to threats faster and more effectively. You will work closely with security operations, incident response, threat detection, and engineering teams to automate repetitive tasks, orchestrate complex workflows, and integrate a wide range of security technologies. Your expertise in security automation, scripting, and platform engineering will help clients mature their security operations, reduce response times, and maximize the value of their cybersecurity investments.

  Then Responsibilities:

  Responsibilities

  • Designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations.
  • Implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem.
  • Collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions.
  • Designing and developing playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows.
  • Leveraging programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications (e.g., integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms).
  • Contributing to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements.
  • Mentoring junior team members, providing technical leadership on security automation initiatives, and contributing to the continued growth of the cybersecurity engineering practice.
  • Staying current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions; participating in professional development opportunities, industry forums, technical communities, and relevant training.
  Skills:

  Skills

  • Advanced problem-solving and critical thinking skills.
  • Strong software engineering and automation development capabilities.
  • Ability to foster a collaborative learning environment and mentor junior team members.
  • Ability to identify and communicate opportunities to improve security operations through automation and orchestration.
  • Experience designing scalable and maintainable integrations across complex technology environments.
  • Ability to create and deliver high-quality work products, technical documentation, client reports, and presentations.
  • Adherence to service quality standards and program management requirements.
  • Ability to work collaboratively in a cross-functional team environment that is culturally diverse and geographically dispersed.
  • Strong analytical and troubleshooting skills, with the ability to diagnose and resolve complex integration and workflow issues.
  • Ability to balance security, operational efficiency, and engineering best practices when developing automation solutions.
  Qualifications (Requirements): We need to include both mandatory and ideal qualifications. We'll have:

  Qualifications

  • Bachelor’s degree (4-year degree) in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, along with 2-4 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
  • Hands-on experience implementing, administering, or developing solutions within enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR (Phantom), Google Security Operations (Chronicle SOAR), Tines, D3 Security, Swimlane, or similar technologies.
  • Strong software development and scripting experience using languages such as Python, PowerShell, JavaScript, or other automation-focused programming languages.
  • Experience developing and consuming REST APIs, web services, SDKs, and custom integrations.
  • Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case management workflows.
  • Experience integrating cybersecurity technologies such as SIEM, EDR/XDR, IAM, email security, network security, cloud security, vulnerability management, threat intelligence, and ticketing platforms.
  • Understanding of infrastructure, networking, operating systems, and cloud environments including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
  • Experience designing, testing, troubleshooting, and maintaining automation workflows in production environments.
  • Knowledge of secure development principles and software engineering best practices including version control, testing methodologies, and CI/CD concepts.
  • Relevant industry certifications such as Microsoft Certified: Cybersecurity Architect Expert, Microsoft SC-200, Splunk Core Certified Power User, Security+, CySA+, GSEC, GCIH, Cortex XSOAR Engineer, or similar certifications, or the ability to acquire certification after employment.
  • Ideally, also have experience architecting enterprise-scale SOAR implementations and security automation programs.
  • Experience developing custom integrations, reusable automation frameworks, and advanced workflow orchestration solutions.
  • Familiarity with Infrastructure as Code (IaC) technologies such as Terraform, ARM templates, Bicep, or CloudFormation.
  • Experience working with DevSecOps, CI/CD pipelines, and cloud-native automation technologies.
  • Ability to communicate effectively during technical workshops, architecture reviews, client interviews, and executive briefings.
  • Exemplary writing skills and the ability to communicate complex technical concepts to both technical and non-technical audiences.
  • Ability to translate operational requirements into automation strategies, technical designs, and implementation roadmaps.
  • Ability to break down complex engineering challenges into manageable components, estimate level-of-effort, and deliver solutions within tight timelines.
  • Proficiency with consulting engagement methodologies and approaches, understanding how to align technical solutions with client business objectives.
  • Familiarity with emerging security automation trends, AI-assisted security operations, and modern cybersecurity technologies.
  What We Look For could be merged into Qualifications or Skills; but we already have Qualifications covering many. The "What We Look For" paragraph: "We seek top performers with a passion for cybersecurity engineering and automation, combined with a proven track record of delivering innovative technical solutions. Ideal candidates are individuals who demonstrate strong engineering expertise, learning agility, critical thinking, and the ability to work collaboratively in a fast-paced environment. We value professionals who are motivated by solving complex challenges, improving security operations through automation, and helping clients strengthen their cyber defenses through modern engineering practices." We could add as a bullet under Qualifications or maybe as a separate section "What We Look For". But instruction: prefer few substantive sections over many thin ones. Could incorporate into Qualifications as a bullet. But we already have many bullets; adding another may be okay. However we could incorporate as a paragraph under Qualifications before list? But we need to use
  • for any list of duties/requirements/benefits. The "What We Look For" is prose, not a list. Could be a

    under Qualifications heading. But we already have a heading Qualifications; we could add a

    then

    . That's fine. Similarly "What We Offer You" includes Benefits and Pay. We'll split. Benefits: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options. Pay: salary ranges as given. We need to include Pay section only if posting states them. Yes. We'll have:

    Benefits

    • Medical and dental coverage
    • Pension and 401(k) plans
    • Wide range of paid time off options

    Pay

    The salary range for this job is:

    • New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern