Cyber - SOAR (Security Orchestration, Automation and Response) Engineer - Senior Manager

At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. The Opportunity In a rapidly evolving cybersecurity landscape, organizations face increasingly sophisticated threats while managing growing security operations workloads. Clients across industries look to us for innovative solutions that improve efficiency, enhance visibility, and strengthen cyber resilience through automation and orchestration. As a SOAR Engineering Senior Manager, you will lead complex security automation transformation programs and help shape the growth of our Security Operations and SOAR capabilities. You will serve as a trusted advisor to CISOs and senior security leaders, helping clients define automation strategies, target operating models, technology roadmaps, and investment priorities. You will provide strategic and technical leadership across enterprise SOAR programs, from strategy and architecture through implementation and operationalization. Working across Security Operations, Incident Response, Detection Engineering, Threat Intelligence, and broader technology teams, you will help clients transform how security operations are delivered at scale. Your Key Responsibilities Lead a portfolio of complex SOAR and security automation engagements, providing strategic and technical oversight from discovery and architecture through implementation, deployment, and operationalization. Serve as a trusted advisor to CISOs and senior security leaders, translating security operations challenges into automation strategies, target operating models, capability roadmaps, and investment priorities. Define and drive enterprise security automation strategies, including use-case portfolios, prioritization frameworks, platform strategy, governance, operating models, and adoption roadmaps. Provide architecture and engineering oversight for enterprise SOAR solutions, ensuring designs are scalable, secure, resilient, maintainable, and aligned with client requirements and technology strategies. Oversee automation across incident triage, enrichment, investigation, containment, remediation, threat intelligence, detection engineering, case management, and reporting, including integrations with SIEM, EDR/XDR, and other security platforms. Lead executive briefings, architecture reviews, technical workshops, and strategic planning sessions, translating complex technical and operational issues into clear recommendations and executive decision points. Own engagement performance across scope, financials, staffing, milestones, risks, dependencies, delivery quality, and client satisfaction, while ensuring successful outcomes across concurrent workstreams. Build and maintain senior client relationships, identify emerging client needs, and shape opportunities to expand engagements across security automation and broader Security Operations capabilities. Lead and contribute to business development activities, including solution shaping, proposals, statements of work, estimates, client presentations, and pursuit activities. Develop and evolve SOAR service offerings, methodologies, reusable frameworks, accelerators, reference architectures, and engineering standards that enable consistent delivery and support practice growth. Lead, coach, and develop Managers, Senior Consultants, engineers, and multidisciplinary teams, providing technical direction, performance feedback, mentorship, and career development. Drive innovation across Security Operations by evaluating and operationalizing AI-assisted security, generative AI, advanced orchestration, cloud-native automation, and emerging technologies, with appropriate governance and controls. Lead a portfolio of complex SOAR and security automation engagements, providing strategic and technical oversight from discovery and architecture through implementation, deployment, and operationalization. Skills and Attributes for Success Demonstrated ability to lead large, complex cybersecurity transformation programs and multiple concurrent client engagements. Deep understanding of Security Operations and the ability to connect business objectives, operating models, processes, architecture, engineering, and technology. Strong executive presence with demonstrated ability to advise and influence CISOs, CIOs, and senior technology and business leaders. Deep knowledge of SOAR, security automation, incident response, threat detection, and modern SOC operating models. Demonstrated ability to translate operational requirements into target-state architectures, transformation roadmaps, investment cases, and measurable outcomes. Experience overseeing scalable integrations and automation solutions across complex enterprise and cloud environments. Strong commercial and consulting acumen, including engagement economics, estimation, resource planning, risk management, proposals, statements of work, and account development. Demonstrated experience building client relationships and identifying and shaping new business opportunities. Experience developing cybersecurity service offerings, reusable methodologies, accelerators, or intellectual property. Strong leadership and talent-development skills, with experience coaching and developing cybersecurity professionals and emerging leaders. Ability to operate effectively across multidisciplinary, geographically distributed teams and complex stakeholder environments. To Qualify for the Role, You Must Have: A bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Information Technology, Management Information Systems, or a related field and significant relevant experience in security automation, SOAR engineering, security operations, cybersecurity engineering, or a related discipline. Demonstrated experience leading enterprise-scale security automation or SOAR transformation programs and providing oversight across multiple workstreams or engagements. Experience with enterprise SOAR and security automation technologies such as Palo Alto Cortex XSOAR, Microsoft Sentinel Automation, Splunk SOAR, Google Security Operations, Tines, D3 Security, Swimlane, or comparable platforms. Strong understanding of software development and scripting concepts using Python, PowerShell, JavaScript, or other automation-focused languages, with the technical depth necessary to guide engineering teams and review solution approaches. Experience designing and consuming REST APIs, web services, SDKs, custom integrations, and reusable automation frameworks. Deep knowledge of SOC processes including alert triage, incident response, threat detection, threat intelligence, vulnerability management, case management, and security operations governance. Experience integrating security capabilities across SIEM, EDR/XDR, IAM, email, network, cloud, vulnerability management, threat intelligence, ticketing, and collaboration platforms. Understanding of enterprise infrastructure, networking, operating systems, and major cloud platforms including Microsoft Azure, AWS, and Google Cloud. Experience leading client-facing consulting engagements, managing delivery and financial risks, and communicating complex recommendations to senior and executive stakeholders. Demonstrated experience contributing to business development, proposals, solution shaping, client presentations, and expansion of existing client relationships. Ideally, You'll Also Have: Experience establishing or scaling enterprise security automation programs, SOAR centers of enablement, or broader Security Operations transformation initiatives. Experience developing reusable automation frameworks, reference architectures, orchestration patterns, and platform governance standards. Familiarity with Infrastructure as Code technologies such as Terraform, ARM templates, Bicep, or CloudFormation. Experience with DevSecOps, CI/CD pipelines, cloud-native automation, containers, and serverless technologies. Experience defining automation use-case portfolios, prioritization frameworks, adoption roadmaps, value realization metrics, and business cases. Experience with AI-assisted Security Operations, generative AI, agentic automation, and governance controls for AI-enabled security workflows. Experience developing new cybersecurity offerings, methodologies, accelerators, thought leadership, or go-to-market strategies. Experience managing and developing Managers and senior cybersecurity practitioners across geographically distributed teams. Established relationships or experience supporting cybersecurity transformation programs for large enterprise clients. What we look for We seek experienced cybersecurity leaders who combine technical credibility, strategic thinking, commercial acumen, and people leadership. Successful Senior Managers can move comfortably between executive conversations about security transformation and investment priorities and detailed discussions with engineering teams about architecture, integrations, automation, and operational challenges. You will be expected not only to deliver successful client outcomes, but also to grow trusted client relationships, develop our people, shape new solutions, and contribute to the continued growth of the Security Operations and automation practice. What we offer you At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers . The salary range for this job is: New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $204,800 to $425,500 Bay Area California offices – $213,300 to $443,200 All other offices locations in the US, including Sacramento – $170,600 to $390,000 Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. Are you ready to shape your future with confidence? Apply today. To make the most of your application experience, please limit yourself to two applications within a six-month period. EY accepts applications for this position on an on-going basis. For those living in California, please click here for additional information. At EY, our values set the foundation for how we work and the behaviors we expect of our people. Any misrepresentation or falsification of information or lack of integrity at any point in the recruiting process may result in withdrawal of your candidacy, revocation of an offer or immediate termination of employment. EY | Building a better working world EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets. Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow. EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories. All in to shape the future with confidence. EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law. EY is committed to providing reasonable accommodation to qualified ind