About the Role
The SOAR Engineer is responsible for monitoring, developing, and maintaining vital aspects of Cyber Security Services and improving operational efficiency. Effective utilization of tools and expertise is crucial to ensuring the organization and customers can quickly identify, understand, and respond to cyber security incidents. The ideal candidate will possess strong technical knowledge of cyber systems and incident response, alongside a keen desire to enhance processes through automation.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Responsibilities
- Act as a Technical Subject Matter Expert, serving as the primary point of contact for Security Automation, Orchestration, Playbooks, Python Automation, API-based automation, Incident Response lifecycle automation, and Security Automation.
- Develop, implement, and execute standard procedures for SOAR platform administration.
- Design, deploy, and maintain SOAR platforms, including content management, change management, version/patch management, and lifecycle management.
- Collaborate closely with the Security Operations Center (SOC) and Security Engineering teams to enhance existing automation and deliver robust security solutions.
- Assess, design, and improve SOC processes and workflows with a focus on integrating automation via Security Orchestration, Automation and Response (SOAR) tools.
- Implement SOC automation and ensure ongoing compatibility with existing detection and response tools.
- Integrate new sources and create playbooks to properly triage and respond to security incidents, while minimizing the time needed to analyze each event.
- Develop custom scripts to automate current detection and response workflows.
- Build pipelines to enrich logs and alert results, providing SOC analysts with a comprehensive view.
- Operate and help mature SOC playbooks, workflow automations, and use cases.
- Assist with client setup, transition, and onboarding, acting as the primary point of contact for Managed Security Service clients.
Qualifications
Educational Qualifications
- Relevant Degree
- Additional certifications in SOAR related to a SOAR platform.
Total Experience
- A minimum of 3 years’ experience in SOAR implementation and support, or a minimum of 5 years or more experience in a cyber security engineering role.
Required Skills
- Proven experience with Security Orchestration, Automation and Response (SOAR) technologies (e.g., Palo Alto Cortex XSOAR, Splunk SOAR/Phantom, Microsoft Sentinel Automation/Logic Apps, IBM Resilient).
- Strong understanding of security architecture, tool integration, API development, and automation.
- Familiarity with Incident Response processes (Detection, Investigation, and Response).
- Knowledge of common SOC processes and workflows.
- Proficient in Python scripting for automation and familiarity with REST APIs, JSON, HTML/CSS, JavaScript, and XML.
- Experience in developing dashboards and reports focused on cyber security operations.
- In-depth knowledge of operating system internals for both Linux and Windows platforms.
- Demonstrated capability in building or customizing integrations/playbooks with widely-used security tools (e.g., Palo Alto/Fortinet firewalls, CrowdStrike/SentinelOne EDR, Splunk/QRadar/Sentinel SIEM, ServiceNow/Jira ticketing).
- Proven experience integrating SOAR platforms with ITSM systems (e.g., Jira, ServiceNow, etc.).
- Strong problem-solving skills and the ability to work independently.
- Exceptional written and verbal communication skills.
Desirable
- Familiarity and experience working within the region.
- Previous experience in a Managed Security Service Provider (MSSP) or Managed Detection and Response (MDR) provider role.
