SOAR Engineer

Key Responsibilities

• Inventory every alert type from the EDR, NDR, identity threat detection, CASB, and enterprise browser platforms, including volume and historical disposition.
• Build a triage decision matrix with Cyber Defence defining enrichment, false positive criteria, escalation criteria, and severity, and document handoffs with our MSSP and EDR MDR provider.
• Build Tines integrations using the credential store and least-privilege service accounts.
• Develop reusable Tines components for enrichment, determination, native tool disposition, and Jira documentation.
• Build, test, and enable playbooks for all in-scope alert types, with error handling and failure alerting.
• Run playbooks in approval mode before enabling autonomous closure, and implement allowlists, audit logging, and a kill switch.
• Instrument metrics for volume, determinations, analyst overrides, time to triage, and playbook failures.
• Write runbooks for every playbook, deliver knowledge transfer, and provide an exit memo summarizing final automation coverage and disposition performance per source.

Required Qualifications

• Hands-on SOAR experience building and operating production stories, including credentials, sub-stories, HTTP and API actions, and error handling. Sanitized examples are required.
• Senior role in a SOC, or senior engineering support of a SOC, with a minimum of five years in security operations.
• Experience automating triage and enrichment for EDR and NDR alerts.
• Working knowledge of REST APIs, JSON, and webhooks.

Preferred Qualifications

• API experience with EDR, NDR, identity threat detection, CASB, or enterprise browser platforms, or with Jira.
• Experience working alongside an MSSP or MDR provider in a co-managed model.