Job Description

SOAR Developer

Department: Security Operations Center (SOC)

Position Summary

We are seeking a Security Orchestration, Automation, and Response (SOAR) Developer to join our Security Operations Center (SOC) team. The ideal candidate is process driven, efficient, and motivated to remove tedium from daily workflows. The developer will support the modernization of SOC cybersecurity operations and respond to emergent development requirements from Security Operations.

The role operates within a DevSecOps model in which incident response staff and development engineers participate together across the entire lifecycle, from design and development through production support. The developer will help identify and deploy security analytics, alerting, and automation solutions based on organizational requirements, including technical integration with key data inputs (such as raw security telemetry combined with referential data).

Key Responsibilities

Automation & Development

• Automate SOC security incident response processes to analyze and resolve alerts from existing security tools through a single stream management system
• Author, test, and maintain automation scripts and workflows within the SOAR platform
• Integrate the SOAR platform with other security tools and APIs to execute automated workflows
• Develop and maintain custom applications for SOC workflows
• Design, implement, and maintain efficient, reusable Python, JavaScript, and JSON code
• Review, debug, and resolve technical issues throughout all stages of the SDLC

Process Improvement

• Assist with process development and improvement for the SOC, including creating and modifying SOPs, playbooks, and work instructions

Collaboration & Mentorship

• Coordinate with system administrators and engineers to provision service accounts and grant required permissions
• Mentor and train team members on SOC processes, governance, and frameworks

Qualifications

Education

• Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related field

Experience & Skills

• 2+ years of experience in one or more cybersecurity focus areas, such as SOC or network security
• Experience with SOAR platforms such as Swimlane, Phantom, or XSOAR
• Experience with SIEMs such as Splunk, XSIAM, or QRadar
• Proficiency in Python scripting
• Working knowledge of REST APIs, JSON, HTML/CSS, JavaScript, and XML
• Experience with Visual Studio
• Experience in a DevSecOps environment
• Experience with security process mapping, analysis, and improvement concepts, models, and best practices
• Experience authoring SOC SOPs, playbooks, work instructions, and other process documents
• An investigative mindset: understanding the reason behind each task, determining next steps based on results, and keeping the overall goals of the process in view

Measures of Success

• Actively maintains and troubleshoots SOAR systems
• Maintains skills to stay current with existing and emerging technologies
• Collaborates and cooperates professionally with SOC team members and internal partners
• Develops prioritization and multitasking skills and adapts successfully to change in a fast-paced environment

Team Culture

Our team is fast paced, fun, energetic, motivated, and hardworking. Candidates are expected to integrate quickly into a results-driven, solution-oriented culture. The team delivers high-quality results on challenging projects and values the belief that outcomes are linked to effort rather than chance, along with the tendency to set challenging yet realistic goals.