SOAR Engineer (Splunk)

Stack

Responsibilities

• ▹Work in partnership with the incident response team to design, identify, and implement opportunities for improvement
• ▹Develop and implement automations for detection and response
• ▹Act as subject matter expert on big data analytics and automation
• ▹Participate in special projects and perform other duties as assigned
• ▹Produce system analytics to prove automation behaviour assumptions
• ▹Document all system changes in line with change management good practices
• ▹Recommend, develop, and release new use cases to maximize the benefits of the SOAR platform
• ▹Mentor junior members of the SOAR team
• ▹Complete quality assurance on work completed by other team members before production implementation

Requirements

• ▹Experience with Splunk, Splunk Enterprise Security, Splunk SOAR (formerly Splunk Phantom), and Splunk User Behaviour Analytics
• ▹A passion for security automation and a solid understanding of security incident response
• ▹Knowledge of security frameworks including MITRE ATT&CK and NIST
• ▹Working experience with operating systems (Windows, UNIX/Linux) and databases
• ▹Knowledge of scripting and programming languages (Java, Perl, R, Python, C++)

Nice to have

• ▹Understanding of NIS regulations
• ▹Understanding of CNI, ideally the energy sector
• ▹Understanding of NCSC CAF and IT/OT controls such as NIST
• ▹Integration of SOAR (Splunk) with OT-specific IDS such as Nozomi, Claroty, Dragos
• ▹Playbook development experience

Soft skills

What we offer

• ▹Flexible working
• ▹25 days holiday plus bank holidays, with the option to buy up to 5 additional days
• ▹Medicash & Critical Illness Scheme
• ▹Pension, life assurance, and Share Save Scheme
• ▹Community & volunteering programmes
• ▹Green Car Scheme
• ▹Cycle to work scheme
• ▹Special time off for major life events (marriage, becoming a grandparent, etc.)
• ▹Generous maternity and paternity leave, plus support for fertility treatments