SOAR Engineer

Salary: $89,997 - 108,383 per year

Requirements:

• Active Top Secret (TS) clearance
• Working knowledge of SOAR platforms, particularly Palo Alto Cortex XSOAR
• Experience integrating SOAR platforms with SIEM technologies, such as Elastic SIEM
• Hands-on experience developing, testing, and maintaining SOAR automation playbooks
• Experience building and troubleshooting connectors and integrations between SOAR and third-party vendor systems
• Familiarity with cybersecurity tools and enterprise security data sources such as Tanium, Microsoft Defender, and Patriot, or comparable platforms
• Ability to analyze detection-rule and SOAR-cluster health data and troubleshoot orchestration or performance issues
• Experience managing or supporting cloud-hosted applications
• Strong collaboration skills and ability to work effectively with cybersecurity analysts, content developers, engineers, and government stakeholders
• Strong written and verbal communication skills, including the ability to turn analyst feedback into actionable engineering improvements
• Bachelors degree in Computer Science, Cybersecurity, Information Systems, or a related field, or equivalent experience
• Experience in SOAR/SIEM engineering or cybersecurity operations
• Previous experience supporting government or DoD cybersecurity operations environments
• Familiarity with Air Force Cloud One and running applications in Air Force cloud environments

Responsibilities:

• Support integration of our Global SIEM and Global SOAR platforms so SIEM-generated alerts can be received and triaged automatically
• Develop and maintain integrations between SOAR and U.S. Air Force systems, including Tanium, Microsoft Defender, Patriot, and other mission-relevant platforms
• Work with SIEM engineering teams to identify vendor data sources and establish appropriate connectivity and integrations
• Design, develop, test, and maintain automation playbooks in Palo Alto Cortex XSOAR
• Partner with content development teams to create playbooks that reduce manual analyst work and improve operational efficiency
• Monitor SOAR cluster health and detection-rule performance, identifying and resolving issues that affect orchestration, automation, and alerting
• Build and troubleshoot connectors and integrations between SOAR and third-party security platforms
• Validate dashboards for accuracy, availability, and relevance to cybersecurity operations and end users
• Gather analyst feedback and use it to improve SOAR playbooks, dashboards, and workflows
• Analyze system health and performance data to troubleshoot orchestration and operational issues
• Support applications hosted in cloud environments
• Collaborate with cybersecurity analysts, content developers, engineering teams, and government stakeholders
• Develop and maintain technical documentation and communicate technical information effectively

Technologies:

• Cloud
• Support
• Security
• DevOps

More:

At GES, we are seeking an experienced SOAR Engineer to support a large-scale cybersecurity operations environment. The role focuses on integrating and maintaining global SIEM and SOAR platforms and developing automation and integrations that help security analysts work more efficiently. We offer an annual salary of $89,996.55–$108,382.94. This is an in-person position.

last updated 43 week of 2026