Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Senior - Consulting

We need to output only HTML fragment, using

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include sections only when posting has real specific content. We need to parse the job posting. Let's extract content: - Location: Anywhere in Country (but we drop location? It's metadata; we can put in short

maybe. The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it. So location can be a short

. - Opening paragraph: "At EY, we’re all in to shape your future with confidence..." This is about the role? Could be "About the role" or maybe "About EY". The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to decide which sections exist. We have: - About the role: The Opportunity paragraph describing the role. Also maybe "The Opportunity" heading. We'll treat that as About the role. - Responsibilities: "Your Key Responsibilities" section with bullet list (actually paragraphs). We'll extract responsibilities as list items. - Requirements: There's "To Qualify for the Role, You Must Have:" which lists qualifications (education, experience, etc). That could be Requirements. - Qualifications: maybe separate? The posting also has "Skills And Attributes For Success" and "Ideally, You'll Also Have". Those could be Skills. - Benefits: "What We Offer You" includes total rewards: medical/dental, pension/401k, paid time off. Also salary ranges. So Benefits and Pay sections. - Schedule: Not mentioned. So we should not include Schedule section. - Also there is "What We Look For" maybe could be part of Skills or Requirements? But we can incorporate into Skills or maybe omit if redundant. We must not invent sections with filler. So we include sections only if there is substantive content. We need to preserve all substantive information; do not invent or summarize away detail. So we need to include details like salary ranges, benefits, etc. We must not repeat the job title as a heading. The job title is Senior SOAR Engineer. Not to repeat. We must not include boilerplate like EEO, legal, etc. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to strip out the long EY boilerplate at the end (equal employment opportunity, accommodation, etc). Also remove "Apply today." etc? That's application instructions; we should remove application instructions. Also remove "To make the most of your application experience..." etc. Also remove "EY accepts applications..." etc. Also remove "For those living in California..." etc. Also remove the values statement at the end? That might be considered boilerplate? It's about EY values; maybe not required but could be considered fluff. The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The values statement is not exactly those, but could be considered fluff. However we need to preserve ALL substantive information; values statement may be considered not substantive for the job. Safer to remove it as it's generic. Also remove "EY | Building a better working world" etc. Thus final HTML will have:

Location: Anywhere in Country

maybe.

About the role

with paragraph(s) from The Opportunity.

Responsibilities

with

• items.

  Requirements

  with
  • items from To Qualify for the Role.

    Skills

    with
    • items from Skills And Attributes For Success and Ideally, You'll Also Have (maybe combine). We need to ensure we don't duplicate.

      Benefits

      with
      • items from What We Offer You: medical and dental coverage, pension and 401(k) plans, wide range of paid time off options.

        Pay

        with paragraph(s) containing salary ranges. We must not include Schedule. We need to ensure we don't include filler like "commensurate with experience". Not present. Now extract details precisely. Let's copy relevant sections. About the role: The Opportunity paragraph(s): "The Opportunity In a rapidly evolving cybersecurity landscape, organizations are facing increasingly sophisticated threats while simultaneously managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. Join our dynamic team as a Senior SOAR Engineer, where you'll play a key role in designing, implementing, and optimizing security automation solutions that enable organizations to respond to threats faster and more effectively. You will work closely with security operations, incident response, threat detection, and engineering teams to automate repetitive tasks, orchestrate complex workflows, and integrate a wide range of security technologies. Your expertise in security automation, scripting, and platform engineering will help clients mature their security operations, reduce response times, and maximize the value of their cybersecurity investments." We can keep as one or multiple paragraphs. Use

        . Responsibilities: Under "Your Key Responsibilities As a Senior on the Security Orchestration, Automation and Response (SOAR) team, your key responsibilities would include designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations. You will be responsible for implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem. Your role will involve collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions. You will design and develop playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows. You will leverage programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications. This may include integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms to facilitate seamless orchestration across complex security architectures. You will also contribute to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements. Additionally, as a senior engineer, you will mentor junior team members, provide technical leadership on security automation initiatives, and contribute to the continued growth of the cybersecurity engineering practice. In addition to these responsibilities, you will be expected to stay current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions. You will actively participate in professional development opportunities, industry forums, technical communities, and relevant training to maintain expertise in modern security operations and automation engineering." We need to turn each sentence into

      • ? The instruction: Use
        • for any list of duties/requirements/benefits. So we can break each responsibility into list items. Could be each sentence as an item. Ensure we preserve all substantive information; we can split by sentences. Let's list responsibilities as separate items: - designing, developing, and maintaining automated security workflows that enhance the effectiveness and efficiency of security operations. - implementing and optimizing SOAR platforms by integrating security tools, data sources, and operational processes across the cybersecurity ecosystem. - collaborating with Security Operations Center (SOC), Incident Response, Threat Intelligence, Detection Engineering, and Vulnerability Management teams to identify automation opportunities and translate operational requirements into scalable technical solutions. - designing and developing playbooks that automate incident triage, enrichment, containment, remediation, and reporting activities while ensuring reliability, maintainability, and security of automation workflows. - leveraging programming and scripting languages to develop custom integrations, APIs, connectors, and automation capabilities across cloud environments, security platforms, and enterprise applications (may include integrating SIEM, EDR, IAM, cloud security, threat intelligence, ticketing, and collaboration platforms to facilitate seamless orchestration across complex security architectures). - contributing to the development of automation standards, reusable frameworks, and engineering best practices while assisting clients with SOAR platform deployments, upgrades, and operational enhancements. - mentoring junior team members, providing technical leadership on security automation initiatives, and contributing to the continued growth of the cybersecurity engineering practice. - staying current on emerging cybersecurity threats, automation technologies, cloud-native security capabilities, and evolving SOAR solutions. - actively participating in professional development opportunities, industry forums, technical communities, and relevant training to maintain expertise in modern security operations and automation engineering. We could combine the SIEM etc into same item. Now Requirements: "To Qualify for the Role, You Must Have:" list: - A Bachelor’s degree (4-year degree) in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, along with 2-4 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline. - Hands-on experience implementing, administering, or developing solutions within enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR (Phantom), Google Security Operations (Chronicle SOAR), Tines, D3 Security, Swimlane, or similar technologies. - Strong software development and scripting experience using languages such as Python, PowerShell, JavaScript, or other automation-focused programming languages. - Experience developing and consuming REST APIs, web services, SDKs, and custom integrations. - Knowledge of security operations processes including alert triage, incident response, threat detection, vulnerability management, and case management workflows. - Experience integrating cybersecurity technologies such as SIEM, EDR/XDR, IAM, email security, network security, cloud security, vulnerability management, threat intelligence, and ticketing platforms. - Understanding of infrastructure, networking, operating systems, and cloud environments including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). - Experience designing, testing, troubleshooting, and maintaining automation workflows in production environments. - Knowledge of secure development principles and software engineering best practices including version control, testing methodologies, and CI/CD concepts. - Relevant industry certifications such as Microsoft Certified: Cybersecurity Architect Expert, Microsoft SC-200, Splunk Core Certified Power User, Security+, CySA+, GSEC, GCIH, Cortex XSOAR Engineer, or similar certifications, or the ability to acquire certification after employment. We can make each bullet as
        • . Now Skills: "Skills And Attributes For Success" paragraph: list of bullet-like sentences separated by periods. Let's extract: - Demonstrate advanced problem-solving and critical thinking skills. - Exhibit strong software engineering and automation development capabilities. - Foster a collaborative learning environment and mentor junior team members. - Possess the ability to identify and communicate opportunities to improve security operations through automation and orchestration. - Demonstrate experience designing scalable and maintainable integrations across complex technology environments. - The ability to create and deliver high-quality work products, technical documentation, client reports, and presentations. - Adherence to service quality standards and program management requirements. - The ability to work collaboratively in a cross-functional team environment that is culturally diverse and geographically dispersed. - Strong analytical and troubleshooting skills, with the ability to diagnose and resolve complex integration and workflow issues. - The ability to balance security, operational efficiency, and engineering best practices when developing automation solutions. Then "Ideally, You'll Also Have" list: - Experience architecting enterprise-scale SOAR implementations and security automation programs. - Experience developing custom integrations, reusable automation frameworks, and advanced workflow orchestration solutions. - Familiarity with Infrastructure as Code (IaC) technologies such as Terraform, ARM templates, Bicep, or CloudFormation. - Experience working with DevSecOps, CI/CD pipelines, and cloud-native automation technologies. - The ability to communicate effectively during technical workshops, architecture reviews, client interviews, and executive briefings. - Exemplary writing skills and the ability to communicate complex technical concepts to both technical and non-technical audiences. - The