Senior SOAR Engineer – Splunk Automation

About the role

The Senior SOAR Engineer designs, builds and maintains security automations that detect, investigate and respond to cyber threats. Working closely with the Incident Response team, the role creates new playbooks and delivers scalable automation within the Splunk ecosystem.

Key responsibilities

• Partner with the incident response team to identify and implement improvement opportunities.
• Develop and implement automations for detection and response across the Splunk platform.
• Act as a subject‑matter expert on big‑data analytics and security automation.
• Produce system analytics to validate automation behaviour and assumptions.
• Document all changes following change‑management best practices.
• Mentor junior members of the SOAR team and perform quality‑assurance on their work before production release.

Required profile

• Proven experience with Splunk, Splunk Enterprise Security, Splunk SOAR (Phantom) and Splunk User Behaviour Analytics.
• Strong understanding of security frameworks such as MITRE ATT&CK and NIST.
• Hands‑on experience with Windows, UNIX/Linux operating systems and relational databases.
• Familiarity with critical infrastructure (CNI) environments, especially in the energy sector, and related regulations.

Required skills

• Splunk (Enterprise Security, SOAR, UBA)
• Python
• Java
• Perl
• R
• C++
• Big‑data analytics
• MITRE ATT&CK
• NIST frameworks
• Nozomi, Claroty, Dragos IDS integration

What we offer

• Flexible remote working
• 25 days holiday plus bank holidays, with the option to buy up to 5 additional days
• Medicash & Critical Illness Scheme
• Pension, Life Assurance and Share Save Scheme
• Community volunteering programmes
• Green Car and Cycle‑to‑Work schemes
• Special time off for life events and generous family‑planning benefits