Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Senior - Consulting

We need to output only HTML fragment, with sections as needed. Must not include job title heading. Must include sections only if real content. Use

for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to map content. From posting: - Intro: "Location: Anywhere in Country At EY, we’re all in to shape your future with confidence..." That's about the role? Could be "About the role". We'll put that in

. - "The Opportunity" paragraph: also about role. - "Your Key Responsibilities" heading: we can use

Responsibilities

and then list responsibilities as

• . - "Skills And Attributes For Success": could be

  Skills

  with list. - "To Qualify for the Role, You Must Have:" that's Requirements/Qualifications. Could combine into

  Requirements

  (or Qualifications). We'll use Requirements. - "Ideally, You'll Also Have": could be additional qualifications but we can include in same Requirements or separate? Probably keep as part of Requirements. - "What We Look For": maybe not needed as separate section; could be omitted. - "What We Offer You": includes salary range and benefits. So we need Pay and Benefits sections. Pay: we have salary ranges for different locations. Provide that as

  maybe. Benefits: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options. Schedule: not mentioned, so omit. Also need to include location? Not needed as heading. We must not repeat job title. No metadata like Job ID. We must remove boilerplate: EEO, legal, etc. Remove all that at end. We must preserve all substantive information; not invent. We need to ensure we don't include filler like "commensurate with experience". Not present. We must not create Pay/Schedule/Benefits unless posting actually states them. It does state salary and benefits, so include. We must not include application instructions (like "Apply today", "limit yourself to two applications", etc). Remove those. Also remove "Learn more at ey.com/us/careers." maybe considered boilerplate? It's a link but could be considered part of offer? Might be considered navigation; safer to remove. Also remove "At EY, we harness our collective strength..." that's part of What We Offer You; we can keep that as description before benefits. We need to keep the salary range details. Let's extract substantive content: About the role / The Opportunity: "Location: Anywhere in Country At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. The Opportunity In a rapidly evolving cybersecurity landscape, organizations are facing increasingly sophisticated threats while simultaneously managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a Senior SOAR Engineer, where you'll play a key role in designing, implementing, and optimizing security automation solutions that enable organizations to respond to threats faster and more effectively. You will work closely with security operations, incident response, threat detection, and engineering teams to automate repetitive tasks, orchestrate complex workflows, and integrate a wide range of security technologies. Your expertise in security automation, scripting, and platform engineering will help clients mature their security operations, reduce response times, and maximize the value of their cybersecurity investments." We can combine into a few paragraphs. Responsibilities: list from "Your Key Responsibilities As a Senior on the Security Orchestration, Automation and Response (SOAR) team, your key responsibilities would include designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations. You will be responsible for implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem. Your role will involve collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions. You will design and develop playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows. You will leverage programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications. This may include integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms to facilitate seamless orchestration across complex security architectures. You will also contribute to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements. Additionally, as a senior engineer, you will mentor junior team members, provide technical leadership on security automation initiatives, and contribute to the continued growth of the cybersecurity engineering practice. In addition to these responsibilities, you will be expected to stay current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions. You will actively participate in professional development opportunities, industry forums, technical communities, and relevant training to maintain expertise in modern security operations and automation engineering." We'll turn each sentence into bullet? Could group but better to list each responsibility as

• . We'll split by sentences. Skills And Attributes For Success: list each bullet. We'll extract each attribute: - Demonstrate advanced problem-solving and critical thinking skills. - Exhibit strong software engineering and automation development capabilities. - Foster a collaborative learning environment and mentor junior team members. - Possess the ability to identify and communicate opportunities to improve security operations through automation and orchestration. - Demonstrate experience designing scalable and maintainable integrations across complex technology environments. - The ability to create and deliver high-quality work products, technical documentation, client reports, and presentations. - Adherence to service quality standards and program management requirements. - The ability to work collaboratively in a cross-functional team environment that is culturally diverse and geographically dispersed. - Strong analytical and troubleshooting skills, with the ability to diagnose and resolve complex integration and workflow issues. - The ability to balance security, operational efficiency, and engineering best practices when developing automation solutions. We'll make each a
• . Requirements / Qualifications: "To Qualify for the Role, You Must Have:" list. - A Bachelor’s degree (4-year degree) in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, along with 2-4 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline. - Hands-on experience implementing, administering, or developing solutions within enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR (Phantom), Google Security Operations (Chronicle SOAR), Tines, D3 Security, Swimlane, or similar technologies. - Strong software development and scripting experience using languages such as Python, PowerShell, JavaScript, or other automation-focused programming languages. - Experience developing and consuming REST APIs, web services, SDKs, and custom integrations. - Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case management workflows. - Experience integrating cybersecurity technologies such as SIEM, EDR/XDR, IAM, email security, network security, cloud security, vulnerability management, threat intelligence, and ticketing platforms. - Understanding of infrastructure, networking, operating systems, and cloud environments including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). - Experience designing, testing, troubleshooting, and maintaining automation workflows in production environments. - Knowledge of secure development principles and software engineering best practices including version control, testing methodologies, and CI/CD concepts. - Relevant industry certifications such as Microsoft Certified: Cybersecurity Architect Expert, Microsoft SC-200, Splunk Core Certified Power User, Security+, CySA+, GSEC, GCIH, Cortex XSOAR Engineer, or similar certifications, or the ability to acquire certification after employment. "Ideally, You'll Also Have" list: - Experience architecting enterprise-scale SOAR implementations and security automation programs. - Experience developing custom integrations, reusable automation frameworks, and advanced workflow orchestration solutions. - Familiarity with Infrastructure as Code (IaC) technologies such as Terraform, ARM templates, Bicep, or CloudFormation. - Experience working with DevSecOps, CI/CD pipelines, and cloud-native automation technologies. - The ability to communicate effectively during technical workshops, architecture reviews, client interviews, and executive briefings. - Exemplary writing skills and the ability to communicate complex technical concepts to both technical and non-technical audiences. - The ability to translate operational requirements into automation strategies, technical designs, and implementation roadmaps. - The ability to break down complex engineering challenges into manageable components, estimate level-of-effort, and deliver solutions within tight timelines. - Proficiency with consulting engagement methodologies and approaches, understanding how to align technical solutions with client business objectives. - Familiarity with emerging security automation trends, AI-assisted security operations, and modern cybersecurity technologies. We can include these as part of Requirements or as separate "Preferred Qualifications". Since we only have headings: Requirements, Qualifications, Skills. We could put all under Requirements (must have) and maybe add a subsection? But we must not create extra headings not allowed. We could combine both must have and ideally into Requirements section, but that may blur. However instructions: "Prefer a few substantive sections over many thin ones." So we can have Requirements covering both must have and ideally. We'll just list all as
• under Requirements. What We Offer You: includes description and benefits. We need Pay section: salary ranges. We need Benefits section: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options. We also have introductory fluff about shaping future etc. That could be in About the role. Let's craft HTML:

  About the role

  Location: Anywhere in Country. At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. The Opportunity: In a rapidly evolving cybersecurity landscape, organizations are facing increasingly sophisticated threats while simultaneously managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a Senior SOAR Engineer, where you'll play a key role in designing, implementing, and optimizing security automation solutions that enable organizations to respond to threats faster and more effectively. You will work closely with security operations, incident response, threat detection, and engineering teams to automate repetitive tasks, orchestrate complex workflows, and integrate a wide range of security technologies. Your expertise in security automation, scripting, and platform engineering will help clients mature their security operations, reduce response times, and maximize the value of their cybersecurity investments.

  Responsibilities

  • Designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations.
  • Implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem.
  • Collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions.
  • Designing and developing playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows.
  • Leveraging programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications (e.g., SIEM, EDR, IAM, cloud security, threat intelligence,