Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Senior - Consulting
EY · Grand Rapids, MI · 1 mo ago
Hybrid$126k–$210k/yrFull-time
We need to output HTML fragment with sections: About the role? The posting includes "The Opportunity" and description. We need to use for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content.
We need to preserve all substantive info, no boilerplate. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions.
We need to include sections: About the role (maybe from "The Opportunity" paragraph). Responsibilities (list). Requirements (maybe "To Qualify for the Role, You Must Have:" list). Qualifications maybe same as Requirements? The posting has "To Qualify for the Role, You Must Have:" then list of qualifications. Also "Ideally, You'll Also Have" is additional preferred qualifications. Could be part of Qualifications or Skills. Also "Skills And Attributes For Success" is a section.
We need Benefits: The posting mentions "What We Offer You At EY..." includes medical and dental coverage, pension and 401(k) plans, paid time off. Also salary ranges. So Benefits section can include those. Pay section: salary ranges. Schedule: not mentioned, so omit.
We must not repeat job title as heading. No Job ID.
We need to output only HTML fragment, no /, no markdown fences.
We need to use
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content.
We need to preserve all substantive info, no boilerplate. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions.
We need to include sections: About the role (maybe from "The Opportunity" paragraph). Responsibilities (list). Requirements (maybe "To Qualify for the Role, You Must Have:" list). Qualifications maybe same as Requirements? The posting has "To Qualify for the Role, You Must Have:" then list of qualifications. Also "Ideally, You'll Also Have" is additional preferred qualifications. Could be part of Qualifications or Skills. Also "Skills And Attributes For Success" is a section.
We need Benefits: The posting mentions "What We Offer You At EY..." includes medical and dental coverage, pension and 401(k) plans, paid time off. Also salary ranges. So Benefits section can include those. Pay section: salary ranges. Schedule: not mentioned, so omit.
We must not repeat job title as heading. No Job ID.
We need to output only HTML fragment, no /, no markdown fences.
We need to use for each section heading. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve all substantive info, not invent or summarize away detail. So we need to include details like location "Anywhere in Country". The posting says "Location: Anywhere in Country". Should we include that? It's location info. Could be part of About the role or maybe a short
. Not a heading. We'll include a
for location.
We need to remove boilerplate like "At EY, we’re all in to shape your future with confidence..." maybe that's part of About the role? It's generic but maybe keep as part of About the role? It's somewhat fluff but it's in the posting. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we should keep that text as it's part of the posting. However, we should remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The opening paragraph is not boilerplate; it's part of the marketing. We'll keep.
We need to ensure we don't include sections with filler like "commensurate with experience". Not present.
Now structure:
-
Location: Anywhere in Country
- About the role
... (the opportunity paragraph plus maybe the first paragraph about EY). We'll combine.
The "The Opportunity" paragraph: "In a rapidly evolving cybersecurity landscape...". Also preceding sentences: "At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world." We'll include that as part of About the role.
Thus About the role content: combine those.
-
Responsibilities
list each responsibility bullet from "Your Key Responsibilities". Need to extract each bullet as - . The paragraph is long with many sentences; we need to break into list items. The instruction: Use
- for any list of duties/requirements/benefits. So we should convert the responsibilities into list items. We'll need to parse the responsibilities paragraph into distinct items.
Responsibilities text:
"You will be responsible for designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations. You will be responsible for implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem. Your role will involve collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions. You will design and develop playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows. You will leverage programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications. This may include integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms to facilitate seamless orchestration across complex security architectures. You will also contribute to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements. Additionally, as a senior engineer, you will mentor junior team members, provide technical leadership on security automation initiatives, and contribute to the continued growth of the cybersecurity engineering practice. In addition to these responsibilities, you will be expected to stay current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions. You will actively participate in professional development opportunities, industry forums, technical communities, and relevant training to maintain expertise in modern security operations and automation engineering."
We can split each sentence as a list item. That seems appropriate.
-
Skills And Attributes For Success
maybe heading "Skills". The instruction says use for section headings like Skills. So we will use Skills
(or Skills And Attributes For Success?). The allowed headings list includes Skills. We'll use Skills
. Then list items from that section.
Skills section text: "To thrive in this role, you'll need a combination of advanced technical engineering expertise, security operations knowledge, and strong consulting skills. Your professional knowledge and experience will guide you in designing scalable solutions, solving complex technical challenges, and delivering high-quality outcomes for clients. Demonstrate advanced problem-solving and critical thinking skills.Exhibit strong software engineering and automation development capabilities.Foster a collaborative learning environment and mentor junior team members.Possess the ability to identify and communicate opportunities to improve security operations through automation and orchestration.Demonstrate experience designing scalable and maintainable integrations across complex technology environments.The ability to create and deliver high-quality work products, technical documentation, client reports, and presentations.Adherence to service quality standards and program management requirements.The ability to work collaboratively in a cross-functional team environment that is culturally diverse and geographically dispersed.Strong analytical and troubleshooting skills, with the ability to diagnose and resolve complex integration and workflow issues.The ability to balance security, operational efficiency, and engineering best practices when developing automation solutions."
We need to split into list items. Each sentence separated by period. We'll make
- for each.
-
Requirements
maybe combine "To Qualify for the Role, You Must Have:" and "Ideally, You'll Also Have". The instruction says include a section ONLY when posting has real specific content. We have both. Could combine into Requirements (must have) and maybe Qualifications (ideal). But we have separate headings: Requirements, Qualifications. We could put mandatory qualifications under Requirements, and preferred under Qualifications. That seems appropriate.
Thus:
Requirements
list each mandatory requirement.
Mandatory list:
- A Bachelor’s degree (4-year degree) in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, along with 2-4 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
- Hands-on experience implementing, administering, or developing solutions within enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR (Phantom), Google Security Operations (Chronicle SOAR), Tines, D3 Security, Swimlane, or similar technologies.
- Strong software development and scripting experience using languages such as Python, PowerShell, JavaScript, or other automation-focused programming languages.
- Experience developing and consuming REST APIs, web services, SDKs, and custom integrations.
- Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case management workflows.
- Experience integrating cybersecurity technologies such as SIEM, EDR/XDR, IAM, email security, network security, cloud security, vulnerability management, threat intelligence, and ticketing platforms.
- Understanding of infrastructure, networking, operating systems, and cloud environments including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
- Experience designing, testing, troubleshooting, and maintaining automation workflows in production environments.
- Knowledge of secure development principles and software engineering best practices including version control, testing methodologies, and CI/CD concepts.
- Relevant industry certifications such as Microsoft Certified: Cybersecurity Architect Expert, Microsoft SC-200, Splunk Core Certified Power User, Security+, CySA+, GSEC, GCIH, Cortex XSOAR Engineer, or similar certifications, or the ability to acquire certification after employment.
We'll make each as - .
-
Qualifications
(preferred) list from "Ideally, You'll Also Have". Items:
- Experience architecting enterprise-scale SOAR implementations and security automation programs.
- Experience developing custom integrations, reusable automation frameworks, and advanced workflow orchestration solutions.
- Familiarity with Infrastructure as Code (IaC) technologies such as Terraform, ARM templates, Bicep, or CloudFormation.
- Experience working with DevSecOps, CI/CD pipelines, and cloud-native automation technologies.
- The ability to communicate effectively during technical workshops, architecture reviews, client interviews, and executive briefings.
- Exemplary writing skills and the ability to communicate complex technical concepts to both technical and non-technical audiences.
- The ability to translate operational requirements into automation strategies, technical designs, and implementation roadmaps.
- The ability to break down complex engineering challenges into manageable components, estimate level-of-effort, and deliver solutions within tight timelines.
- Proficiency with consulting engagement methodologies and approaches, understanding how to align technical solutions with client business objectives.
- Familiarity with emerging security automation trends, AI-assisted security operations, and modern cybersecurity technologies.
Make each - .
-
Benefits
list from "What We Offer You At EY..." plus maybe also mention professional growth etc. The text: "What We Offer You At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: ... In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options."
We need Benefits section: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options. Also professional growth, personal fulfillment, inclusive culture maybe but those are more intangible. We'll include the tangible benefits.
Thus - Medical and dental coverage
- Pension and 401(k) plans
- Wide range of paid time off options
- Pay
include salary ranges. The posting gives ranges based on location. We need to include that info. Should we list as - ...
or . Since it's a list of ranges, we can use
. We'll include each location range as - .
Thus:
- New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $125,800 to $209,700
- Bay Area California offices – $131,100 to $218,500
- All other offices locations in the US, including Sacramento – $104,800
- for any list of duties/requirements/benefits. Use
for prose. We need to preserve all substantive info, not invent or summarize away detail. So we need to include details like location "Anywhere in Country". The posting says "Location: Anywhere in Country". Should we include that? It's location info. Could be part of About the role or maybe a short
. Not a heading. We'll include a
for location. We need to remove boilerplate like "At EY, we’re all in to shape your future with confidence..." maybe that's part of About the role? It's generic but maybe keep as part of About the role? It's somewhat fluff but it's in the posting. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we should keep that text as it's part of the posting. However, we should remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The opening paragraph is not boilerplate; it's part of the marketing. We'll keep. We need to ensure we don't include sections with filler like "commensurate with experience". Not present. Now structure: -
Location: Anywhere in Country
-About the role
... (the opportunity paragraph plus maybe the first paragraph about EY). We'll combine. The "The Opportunity" paragraph: "In a rapidly evolving cybersecurity landscape...". Also preceding sentences: "At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world." We'll include that as part of About the role. Thus About the role content: combine those. -
Responsibilities
- list each responsibility bullet from "Your Key Responsibilities". Need to extract each bullet as
- . The paragraph is long with many sentences; we need to break into list items. The instruction: Use
- for any list of duties/requirements/benefits. So we should convert the responsibilities into list items. We'll need to parse the responsibilities paragraph into distinct items.
Responsibilities text:
"You will be responsible for designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations. You will be responsible for implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem. Your role will involve collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions. You will design and develop playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows. You will leverage programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications. This may include integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms to facilitate seamless orchestration across complex security architectures. You will also contribute to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements. Additionally, as a senior engineer, you will mentor junior team members, provide technical leadership on security automation initiatives, and contribute to the continued growth of the cybersecurity engineering practice. In addition to these responsibilities, you will be expected to stay current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions. You will actively participate in professional development opportunities, industry forums, technical communities, and relevant training to maintain expertise in modern security operations and automation engineering."
We can split each sentence as a list item. That seems appropriate.
-
Skills And Attributes For Success
maybe heading "Skills". The instruction says usefor section headings like Skills. So we will use
Skills
(or Skills And Attributes For Success?). The allowed headings list includes Skills. We'll useSkills
. Then list items from that section. Skills section text: "To thrive in this role, you'll need a combination of advanced technical engineering expertise, security operations knowledge, and strong consulting skills. Your professional knowledge and experience will guide you in designing scalable solutions, solving complex technical challenges, and delivering high-quality outcomes for clients. Demonstrate advanced problem-solving and critical thinking skills.Exhibit strong software engineering and automation development capabilities.Foster a collaborative learning environment and mentor junior team members.Possess the ability to identify and communicate opportunities to improve security operations through automation and orchestration.Demonstrate experience designing scalable and maintainable integrations across complex technology environments.The ability to create and deliver high-quality work products, technical documentation, client reports, and presentations.Adherence to service quality standards and program management requirements.The ability to work collaboratively in a cross-functional team environment that is culturally diverse and geographically dispersed.Strong analytical and troubleshooting skills, with the ability to diagnose and resolve complex integration and workflow issues.The ability to balance security, operational efficiency, and engineering best practices when developing automation solutions." We need to split into list items. Each sentence separated by period. We'll make - for each.
-
Requirements
maybe combine "To Qualify for the Role, You Must Have:" and "Ideally, You'll Also Have". The instruction says include a section ONLY when posting has real specific content. We have both. Could combine into Requirements (must have) and maybe Qualifications (ideal). But we have separate headings: Requirements, Qualifications. We could put mandatory qualifications under Requirements, and preferred under Qualifications. That seems appropriate. Thus:Requirements
- list each mandatory requirement.
Mandatory list:
- A Bachelor’s degree (4-year degree) in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, along with 2-4 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline.
- Hands-on experience implementing, administering, or developing solutions within enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR (Phantom), Google Security Operations (Chronicle SOAR), Tines, D3 Security, Swimlane, or similar technologies.
- Strong software development and scripting experience using languages such as Python, PowerShell, JavaScript, or other automation-focused programming languages.
- Experience developing and consuming REST APIs, web services, SDKs, and custom integrations.
- Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case management workflows.
- Experience integrating cybersecurity technologies such as SIEM, EDR/XDR, IAM, email security, network security, cloud security, vulnerability management, threat intelligence, and ticketing platforms.
- Understanding of infrastructure, networking, operating systems, and cloud environments including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
- Experience designing, testing, troubleshooting, and maintaining automation workflows in production environments.
- Knowledge of secure development principles and software engineering best practices including version control, testing methodologies, and CI/CD concepts.
- Relevant industry certifications such as Microsoft Certified: Cybersecurity Architect Expert, Microsoft SC-200, Splunk Core Certified Power User, Security+, CySA+, GSEC, GCIH, Cortex XSOAR Engineer, or similar certifications, or the ability to acquire certification after employment.
We'll make each as
- .
-
Qualifications
(preferred) list from "Ideally, You'll Also Have". Items: - Experience architecting enterprise-scale SOAR implementations and security automation programs. - Experience developing custom integrations, reusable automation frameworks, and advanced workflow orchestration solutions. - Familiarity with Infrastructure as Code (IaC) technologies such as Terraform, ARM templates, Bicep, or CloudFormation. - Experience working with DevSecOps, CI/CD pipelines, and cloud-native automation technologies. - The ability to communicate effectively during technical workshops, architecture reviews, client interviews, and executive briefings. - Exemplary writing skills and the ability to communicate complex technical concepts to both technical and non-technical audiences. - The ability to translate operational requirements into automation strategies, technical designs, and implementation roadmaps. - The ability to break down complex engineering challenges into manageable components, estimate level-of-effort, and deliver solutions within tight timelines. - Proficiency with consulting engagement methodologies and approaches, understanding how to align technical solutions with client business objectives. - Familiarity with emerging security automation trends, AI-assisted security operations, and modern cybersecurity technologies. Make each - .
-
Benefits
list from "What We Offer You At EY..." plus maybe also mention professional growth etc. The text: "What We Offer You At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers. The salary range for this job is: ... In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options." We need Benefits section: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options. Also professional growth, personal fulfillment, inclusive culture maybe but those are more intangible. We'll include the tangible benefits. Thus- Medical and dental coverage
- Pension and 401(k) plans
- Wide range of paid time off options
Pay
include salary ranges. The posting gives ranges based on location. We need to include that info. Should we list as- ...
. Since it's a list of ranges, we can use
- . We'll include each location range as
- . Thus: - New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $125,800 to $209,700 - Bay Area California offices – $131,100 to $218,500 - All other offices locations in the US, including Sacramento – $104,800
- .
-
- for any list of duties/requirements/benefits. So we should convert the responsibilities into list items. We'll need to parse the responsibilities paragraph into distinct items.
Responsibilities text:
"You will be responsible for designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations. You will be responsible for implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem. Your role will involve collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions. You will design and develop playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows. You will leverage programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications. This may include integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms to facilitate seamless orchestration across complex security architectures. You will also contribute to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements. Additionally, as a senior engineer, you will mentor junior team members, provide technical leadership on security automation initiatives, and contribute to the continued growth of the cybersecurity engineering practice. In addition to these responsibilities, you will be expected to stay current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions. You will actively participate in professional development opportunities, industry forums, technical communities, and relevant training to maintain expertise in modern security operations and automation engineering."
We can split each sentence as a list item. That seems appropriate.
-
- . The paragraph is long with many sentences; we need to break into list items. The instruction: Use