SOAR Engineer - Splunk - SC Cleared

Location: Remote (UK) with occasional travel to customer sites as required Salary: Up to £100,000 + excellent benefits

About the Role

We are seeking a Principal SOAR Engineer to lead the design, architecture and delivery of advanced security automation solutions across enterprise environments. As the technical authority for SOAR engineering, you will work closely with Incident Response, Security Operations and Engineering teams to define automation strategy, develop scalable playbooks and drive continuous improvements in cyber defence capabilities.

This is a predominantly remote position with occasional travel to customer sites for workshops, technical engagements and project delivery.

Key Responsibilities

• Lead the design and architecture of enterprise-scale SOAR solutions using the Splunk platform.
• Define automation strategy and identify opportunities to improve detection, investigation and response capabilities.
• Design, develop and optimise advanced SOAR playbooks and automated workflows.
• Act as the technical authority for security automation, orchestration and analytics.
• Produce system analytics and performance metrics to validate automation effectiveness.
• Develop and implement new security use cases to enhance SOC efficiency and reduce response times.
• Ensure all changes follow established change management and governance processes.
• Conduct peer reviews and quality assurance for automation developed by the engineering team.
• Mentor and provide technical leadership to senior and junior SOAR engineers.
• Collaborate with customers and internal stakeholders to translate operational requirements into scalable automation solutions.
• Contribute to technical roadmaps, best practices and continuous improvement initiatives.

Required Skills & Experience

• Extensive experience with:
• Splunk Enterprise
• Splunk Enterprise Security (ES)
• Splunk SOAR (formerly Phantom)
• Splunk User Behaviour Analytics (UBA)
• Proven experience designing and implementing enterprise-scale security automation and orchestration.
• Strong understanding of Security Operations and Incident Response.
• Deep knowledge of security frameworks including:
• MITRE ATT&CK
• NIST Cybersecurity Framework
• Experience with Windows, Linux/UNIX and database technologies.
• Strong scripting and automation skills, ideally with Python, alongside experience with Java, Perl or C++.
• Experience creating dashboards, analytics and reporting to demonstrate automation performance and effectiveness.
• Ability to influence technical direction and provide strategic guidance to engineering teams.
• Critical National Infrastructure (CNI) or regulated industry experience.
• Knowledge of NIS Regulations and the NCSC Cyber Assessment Framework (CAF).
• Understanding of both IT and Operational Technology (OT) security.
• Experience integrating Splunk SOAR with OT security platforms such as Nozomi, Claroty or Dragos.
• Experience developing complex SOAR playbooks and enterprise automation frameworks.
• Experience acting as a technical lead or principal engineer within a SOC or cyber security consultancy.

What’s on Offer

• Salary up to £100,000
• Remote-first working with occasional customer site visits.
• Flexible working arrangements.
• Generous annual leave with the option to purchase additional days.
• Private healthcare and wellbeing support.
• Pension, life assurance and employee savings schemes.
• Electric vehicle and cycle-to-work schemes.
• Enhanced family leave and wellbeing benefits.
• Ongoing investment in training, certifications and professional development.

• Extensive experience with:
• Splunk Enterprise
• Splunk Enterprise Security (ES)
• Splunk SOAR (formerly Phantom)
• Splunk User Behaviour Analytics (UBA)
• Proven experience designing and implementing enterprise-scale security automation and orchestration.
• Strong understanding of Security Operations and Incident Response.
• Deep knowledge of security frameworks including:
• MITRE ATT&CK
• NIST Cybersecurity Framework
• Experience with Windows, Linux/UNIX and database technologies.
• Strong scripting and automation skills, ideally with Python, alongside experience with Java, Perl or C++.
• Experience creating dashboards, analytics and reporting to demonstrate automation performance and effectiveness.
• Ability to influence technical direction and provide strategic guidance to engineering teams.
• Critical National Infrastructure (CNI) or regulated industry experience.
• Knowledge of NIS Regulations and the NCSC Cyber Assessment Framework (CAF).
• Understanding of both IT and Operational Technology (OT) security.
• Experience integrating Splunk SOAR with OT security platforms such as Nozomi, Claroty or Dragos.
• Experience developing complex SOAR playbooks and enterprise automation frameworks.
• Experience acting as a technical lead or principal engineer within a SOC or cyber security consultancy.

• Salary up to £100,000
• Remote-first working with occasional customer site visits.
• Flexible working arrangements.
• Generous annual leave with the option to purchase additional days.
• Private healthcare and wellbeing support.
• Pension, life assurance and employee savings schemes.
• Electric vehicle and cycle-to-work schemes.
• Enhanced family leave and wellbeing benefits.
• Ongoing investment in training, certifications and professional development.