SOAR Engineer
Remote
Job Summary
Design, build, and maintain automation workflows and playbooks within the SOAR platform (Torq) to handle automated enrichment, triage, and response across 900 client environments. Integrate these workflows with Microsoft Sentinel, Defender, FortiSIEM, and ticketing systems via APIs and webhooks, while expanding AI-assisted L1 handling to reduce analyst toil. Ensure strict tenant isolation and data safety through disciplined change management, version control, and staged rollouts. Monitor, troubleshoot, and optimize existing automations for accuracy and resilience, partnering with SOC operations to measure hours saved and false positives suppressed. This mid-level role supports a growth path toward automation architecture leadership within a multi-tenant MDR provider.
Required Qualifications
- 2-3+ years in security engineering, SOC engineering, or security automation
- Hands-on experience building production playbooks in a modern SOAR platform
- Experience integrating SOAR with SIEM and endpoint tooling (Microsoft Sentinel, Defender, or comparable platforms), including API-based integrations, JSON handling, and webhooks
- Working understanding of SOC operations and incident response workflows: what analysts actually do at L1/L2, and where automation helps versus harms
- Scripting proficiency in Python (preferred) or PowerShell for integrations, data transformation, and tooling
- Habits of documentation, version control, and controlled change: you test before you ship, and you write down what you built
Desired Qualifications
- Torq experience
- Tines experience
- Palo Alto XSOAR experience
- Swimlane experience
- similar SOAR platform experience
- MDR or MSSP experience operating automation across many client tenants
- Hands-on application of generative-AI or LLM-based agents to SOC automation (enrichment, triage, correlation)
- Exposure to additional SIEM platforms (FortiSIEM, Splunk, QRadar, Exabeam, etc.)
- Detection-as-code exposure: Git-based pipelines, CI/CD for security content
- Microsoft SC-200 certification
- Security+ certification
- equivalent certifications
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.