> Markdown version of [/jobs/ext/2306591-xsoar-soar-engineer](https://www.wearedevelopers.com/jobs/ext/2306591-xsoar-soar-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # XSOAR/SOAR Engineer - **Company:** Nomios Group - **Location:** Basingstoke, UK (Remote available) - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Apple Mac Systems, JIRA, Microsoft Azure, Unix, Command-Line Interface, Cloud Computing, Cyber Security, Linux, Domain Name System (DNS), Event Logging, Intrusion Detection and Prevention, Lightweight Directory Access Protocols (LDAP), Network Connections, Phishing, Kusto Query Language, Salesforce.Com, Security Information and Event Management, Systems Integration, Software Vulnerability Management, Scripting, Mitre Att&ck, SC Clearance, Build Management, Microsoft Sentinel, Integration Frameworks, Cortex XSOAR Platform, SentinelOne Expertise, Qualys, Servicenow - **Published:** August 30, 2026 - **Apply:** https://www.collegerecruiter.com/job/2815439599-xsoarsoar-engineer ## About the Role We hire result-orientated, smart, and high-energy individuals who bring a can-do attitude and a willingness to go the extra mile and deliver exceptional outcomes. You should be organised and rigorous, with excellent analytical skills. Good communication with internal stakeholders is vital, as is the ability to work as part of a dynamic team., * Minimum 1 year in a Security Operations Centre (SOC), or * Minimum 3 years in infrastructure or networking roles with demonstrable security exposure. * Experience triaging and investigating security alerts. * Understanding of attacker behaviours, TTPs, and common malware execution chains (e.g., phishing leading to script or binary execution). * Ability to recognise indicators of compromise such as unusual processes, network connections, irregular logon activity or file changes. * Hands-on experience with at least one major security platform (SIEM, EDR or XDR). * Familiarity with ticketing tools such as ServiceNow, Salesforce, or JIRA. * Familiarity with Windows event logs, authentication logs, basic process trees, and command-line tools (Windows & Unix-like systems). * Understanding of core network protocols: DNS, HTTP, SMB, LDAP. * Operational knowledge of Windows, macOS and Linux. * Ability to read and interpret logs from multiple sources. * Awareness of MITRE ATT&CK and differentiating legitimate admin activity vs suspicious behaviour. Desirable skills * Experience with Microsoft Sentinel, Google SecOps or other SIEM platforms. * Experience with Defender, CrowdStrike, SentinelOne or other XDR solutions. * Ability to query in KQL, CQL, S1QL, XQL or similar languages. * Awareness of threat intelligence concepts and application to investigations. * Awareness of coding or scripting, with proficiency in at least one language preferred (but not required)., * Security clearance : Eligibility for SC clearance (lived in the UK for five years consecutively) required. DV clearance eligibility is advantageous. ## Description This is a hands-on technical role within the Security Operations domain, focused on helping customers improve and automate their SOC functions, tooling, and detection capabilities. You will work across a range of technologies and engagements, from SOAR and SIEM implementation through to vulnerability management, exposure management, and process automation., Around half of your time will be spent delivering customer-facing Professional Services projects, with the remainder focused on supporting internal engineering initiatives, labs, roadmap activities and innovation within the broader Security Operations Team. This position suits an experienced SOC or Security Engineer who enjoys working across multiple environments and technologies, and who is comfortable engaging directly with customers as a trusted technical consultant. We are particularly interested in speaking to individuals with Azure and Cloud based skillsets., Deliver * Deliver Professional Services engagements across SOAR, SIEM, XDR, vulnerability and exposure management platforms * Conduct Azure and cloud environment security health checks and configuration reviews * Design and build SOAR playbooks, integrations, and automation frameworks * Develop and maintain custom log source parsers, normalisation, and correlation logic * Deploy, configure, and optimise SIEM and XDR solutions for customer environments * Build and tune vulnerability management workflows and dashboards using common tools such as Rapid7, Tenable, and Qualys * Perform CTEM-related assessments using tools such as Cymulate or XM Cyber * Produce clear technical documentation and customer deliverables following each engagement Collaborate * Work closely with the internal SOC Engineering team to align practices and share technical improvements * Support engineering escalations and onboarding for customer environments * Contribute to engineering design sessions, roadmap planning, and internal innovation projects * Mentor and share knowledge with internal engineers and analysts Improve * Identify and implement automation and efficiency improvements across customer and internal toolsets * Contribute to the development of reusable playbooks, connectors, and integration frameworks * Support the continual enhancement of Nomios' Professional Services delivery templates, labs, and testing environments ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray) - [WeAreDevelopers LIVE - Node and Package Security](https://www.wearedevelopers.com/videos/2138-wearedevelopers-live-node-and-package-security) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [Collaboration Quantified: Lessons from Open Source Developer Networks](https://www.wearedevelopers.com/videos/1422-collaboration-quantified-lessons-from-open-source-developer-networks) ## Related Articles - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Find a Developer Job: 12 Best Job Sites For Developers](https://www.wearedevelopers.com/magazine/165-find-a-developer-job-12-best-job-sites-for-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023)