NCC Group

Global cyber security and resilience provider

Senior SOAR Engineer - Splunk

Security Operations & Incident ResponseUpdated on Nov 13

Full-timeRemote in UKNo salary listedRemote

About the Job

Requirements

Experience with Splunk, Splunk Enterprise Security, Splunk SOAR (formerly Splunk Phantom), and Splunk User Behaviour Analytics.
A solid understanding of security incident response and an interest in security automation.
Knowledge of security frameworks, including MITRE ATT&CK and NIST.
Working experience and knowledge of operating systems such as Windows and UNIX/Linux, and databases.
Knowledge of scripting and programming languages, including Java, Perl, R, Python, and C++.

Responsibilities

Work with the incident response team to identify and implement opportunities for improvement.
Develop and implement automations for detection and response.
Serve as a subject matter expert in big data analytics and automation.
Participate in special projects and perform other duties as assigned.
Produce system analytics to test assumptions about automation behaviour.
Document system changes in line with change-management good practices.
Recommend, develop, and release new use cases to maximize the benefits and efficiency of a SOAR platform.
Mentor junior members of the SOAR team.
Perform quality assurance on other team members’ work before it is implemented in production.

Desired Qualifications

Understanding of NIS regulations.
Understanding of critical national infrastructure (CNI) and ideally the energy sector; experience in a CNI environment or with a CNI client is desirable.
Understanding of NCSC CAF and information technology/operational technology (IT/OT) controls such as NIST.
Experience integrating Splunk SOAR with OT-specific intrusion detection systems (IDS), such as Nozomi, Claroty, or Dragos.
Playbook development.

The Senior SOAR Engineer designs, builds and maintains security automations that detect, investigate and respond to cyber threats. The role works closely with Incident Response to identify improvements, create new playbooks and deliver scalable automation within the Splunk ecosystem. Responsibilities include advanced analytics, scripting, creating new use cases, validating automation behaviour, documenting changes and mentoring junior engineers.

Work in partnership with the incident response team to design, identify, and implement opportunities for improvement
Develop, and implement automations for detection and response.
Be the subject matter experts on big data analytics and automation
Participate in special projects, as needed, and perform other duties as assigned
Produce System Analytics to prove automation behaviour assumptions
Document all system changes in line with Change Management good practices
Recommend, Develop and Release new Use Cases to maximize the benefits and efficiencies from a SOAR platform.
Mentor junior members of the SOAR team.
Complete Quality Assurance on work completed by other members of the team before it is implemented in production.

Experience with Splunk, Splunk Enterprise Security, Splunk SOAR (Formerly Splunk Phantom) and Splunk User Behaviour Analytics
Develop, and implement automations for detection and response.
Produce System Analytics to prove automation behaviour assumptions
A passion for security automation and a solid understanding of security incident response
Knowledge of security frameworks including MITRE ATT&CK, NIST, etc.
Working experience and knowledge of operating systems (e.g.: Windows, UNIX/Linux) and databases
Knowledge in various scripting and programming languages (Java, Perl, R, Python, C++)

Desirable:

Understanding of NIS regulations
Understanding of CNI and ideally the Energy Sector. Ideally having worked on a CNI environment/client.
Understanding of NCSC CAF and IT/OT controls such as NIST
Integration of SOAR (Splunk) with OT specific IDS such as Nozomi, Claroty, Dragos, etc.
Playbook development.

About the Company

NCC Group

Global cyber security and resilience provider

NCC Group provides cyber security and resilience services to organizations and governments around the world. It helps protect digital systems by offering a range of capabilities such as security testing, risk assessment, and resilience planning, backed by a global team of experts and supported by technology-enabled tools. The company’s approach combines human expertise with technical solutions to identify vulnerabilities, assess risk, and implement concrete steps to improve security and continuity. What sets NCC Group apart is its large, worldwide team and its emphasis on practical, end-to-end cyber resilience—working with clients from assessment through to implementation and ongoing assurance. The goal is to create a more secure digital future by helping customers manage cyber risk, reduce threats, and maintain business continuity at scale.

Company size: 1,001-5,000
Company stage: IPO
Headquarters: Manchester, United Kingdom
Founded: 1999

Recently Posted Jobs

Explore more opportunities at NCC Group

See more jobs