Position: SOAR Support Engineer
Location: Atlanta, GA /Raleigh, NC /Charlotte, NC
We are seeking a highly skilled Cybersecurity Engineer with a strong focus on Security Orchestration, Automation, and Response (SOAR) to join our team. The successful candidate will be responsible for supporting, configuring, and maintaining our SOAR infrastructure and associated data feeds in a Linux environment. The engineer will work closely with customers, developers, and cross-functional teams to ensure the smooth operation and continuous improvement of our SOAR platform, while also handling change management and incident creation/escalation using ServiceNow. The role involves operating in a zero-trust environment.
Resolve complex problems spanning multiple applications to drive improvements across the SOAR platform; lead efforts with significant business implications, participate in planning and priority estimates, and advise Software Engineers, Infrastructure Engineers, Application and Platform owners, and Cyber Teammates on SOAR solutions.
Educate others on current architectural standards and guidelines to drive efficiency when leading the design efforts of complex business and enterprise software solutions.
Build and troubleshoot SOAR Infrastructure and associated data feeds in a Linux environment.
Perform health checks of the SOAR environment, troubleshoot, and restore service.
Support OS teams with monthly server patching for SOAR components.
Perform SOAR platform upgrades on SOAR components.
Troubleshoot existing feeds that are no longer collecting data (quiet source monitoring).
Interact with the SOAR user base for the development, management, and tuning of SOAR dashboards, knowledge objects, ad-hoc/scheduled workflows, and alerts.
Lead data onboarding requirement discussions with consumers of the SOAR platform to determine scope and feasibility.
Interpret and apply new technical and system capabilities as needed to provide updates, enhancements, and modifications to an existing SOAR environment.
Integrate data streams and feeds from network, infrastructure services, mission-critical/business applications into the SOAR platform using various connectors and APIs.
Requirements:
- Bachelor's Degree in Computer Science, CIS, or related field (experience in lieu of degree will be considered)
- Five to seven years of experience in development support or a related field
- 2+ years of experience in database technologies
- 3+ of experience working on project(s) involving the implementation of solutions applying development life cycles (SDLC)
- Experience working in a zero-trust environment
- Familiarity with ServiceNow for change management and incident handling
- Excellent problem-solving and communication skills
- Ability to work independently and as part of a team
- Strong customer service and collaboration skills
Preferred Qualifications:
- Master's Degree in Computer Science, CIS, or related field
- Current Certification in a SOAR platform (e.g., Splunk Phantom, Demisto, IBM Resilient)
- 3+ years of experience building, troubleshooting, and supporting SOAR Infrastructure and associated data feeds in a clustered, multi-site Linux environment
- 3+ years of experience onboarding data to a SOAR platform (Hosted on-Premise)
- 1+ years of experience onboarding data to AWS and/or Azure cloud-hosted SOAR environments
- 3+ years of experience with complex SOAR Deployment strategies that include standard and tiered deployment models, GitLab/GitHub, Ansible, and/or Cribl
- 3+ years of experience with Architecting and Infrastructure Engineering SOAR in On-Premise, AWS, and/or Azure cloud environments
- Experience with common scripting languages such as Bash and Python
- GIAC certifications such as GSEC (GIAC Security Essentials) and GPYC (GIAC Python Coder)
- Additional cybersecurity certifications are a plus
- Experience with Elastic Stack (Elasticsearch, Logstash, and Kibana)
