Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Manager - Consulting

EY is a globally connected professional services organization that provides assurance, consulting, tax, strategy, and transaction services. EY is seeking a SOAR Engineering Manager to lead the design, delivery, and optimization of security automation solutions, advise clients on cybersecurity operations, and manage complex consulting engagements and multidisciplinary teams.

Responsibilities:

• Lead end-to-end SOAR and security automation engagements, from discovery and strategy through architecture, implementation, testing, deployment, and operational transition
• Advise clients on automation strategy, operating models, governance, platform selection, capability roadmaps, and opportunities to improve Security Operations Center (SOC) effectiveness
• Own solution architecture and delivery quality for enterprise SOAR implementations, ensuring designs are scalable, secure, maintainable, and aligned with client requirements
• Direct the design and development of playbooks that automate incident triage, enrichment, investigation, containment, remediation, case management, and reporting activities
• Oversee integrations across SIEM, EDR/XDR, IAM, cloud security, threat intelligence, vulnerability management, email security, network security, ticketing, and collaboration platforms
• Provide technical oversight for custom integrations, APIs, connectors, reusable frameworks, and cloud-native automation capabilities
• Facilitate executive briefings, architecture reviews, technical workshops, stakeholder interviews, and requirements sessions; translate complex findings into clear recommendations and implementation plans
• Manage engagement scope, workplans, risks, dependencies, staffing, financial performance, and delivery milestones while maintaining service quality and client satisfaction
• Establish engineering standards, governance controls, testing practices, documentation expectations, and production support models for automation solutions
• Lead, coach, and develop multidisciplinary teams; review work products, provide actionable feedback, and create an inclusive, collaborative environment
• Identify follow-on opportunities, contribute to proposals and statements of work, support solution development, and help grow the security automation practice
• Maintain awareness of emerging threats, AI-assisted security operations, automation technologies, cloud-native security capabilities, and evolving SOAR platforms

Requirements:

• Strong leadership, structured problem-solving, and critical-thinking skills, with the ability to make sound decisions in complex client environments
• Deep knowledge of security operations and demonstrated ability to connect business objectives, operating processes, and technical architecture
• Ability to lead concurrent workstreams, manage ambiguity, prioritize effectively, and drive accountability across cross-functional teams
• Executive presence and strong written and verbal communication skills, including the ability to influence technical and non-technical stakeholders
• Demonstrated ability to design scalable integrations and automation solutions across complex enterprise environments
• Experience developing high-quality client deliverables, architecture documents, roadmaps, reports, proposals, and presentations
• Commercial awareness, including scope management, estimation, resource planning, risk management, and engagement economics
• Commitment to quality, continuous improvement, mentorship, and inclusive team leadership
• A bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field, and 6-10 years of relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline
• Experience leading teams or workstreams responsible for the design and delivery of security automation or SOAR solutions in enterprise environments
• Hands-on experience with enterprise SOAR platforms such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable technologies
• Strong software development and scripting experience using Python, PowerShell, JavaScript, or other automation-focused languages
• Experience designing and consuming REST APIs, web services, SDKs, and custom integrations
• Strong knowledge of SOC processes, including alert triage, incident response, threat detection, threat intelligence, vulnerability management, and case management
• Experience integrating security technologies across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms
• Understanding of infrastructure, networking, operating systems, and major cloud platforms, including Microsoft Azure, Amazon Web Services, and Google Cloud Platform
• Experience designing, testing, troubleshooting, operationalizing, and governing automation workflows in production environments
• Knowledge of secure development practices, version control, testing methodologies, CI/CD concepts, and software engineering standards
• Ability to lead client-facing engagements, manage delivery risks, and communicate recommendations to senior stakeholders
• Relevant industry or platform certifications, or the ability to obtain an applicable certification after employment
• Experience architecting enterprise-scale SOAR implementations and establishing security automation programs or centers of enablement
• Experience developing reusable automation frameworks, advanced orchestration solutions, and platform governance standards
• Familiarity with Infrastructure as Code technologies such as Terraform, ARM templates, Bicep, or CloudFormation
• Experience with DevSecOps, CI/CD pipelines, cloud-native automation, containers, and serverless technologies
• Experience defining automation use-case portfolios, prioritization criteria, value metrics, and adoption roadmaps
• Ability to translate operational requirements into target-state architectures, implementation roadmaps, estimates, and business cases
• Experience with consulting engagement methodologies, proposal development, statements of work, and executive-level presentations
• Familiarity with AI-assisted security operations, generative AI use cases, and responsible automation controls