NCC GroupSOAR Engineer (SPLUNK)
AI in this role
Senior SOAR Engineer designing and maintaining security automation and threat response playbooks within the Splunk ecosystem.
Key Responsibilities
- Work in partnership with the incident response team to design, identify, and implement opportunities for improvement
- Develop, and implement automations for detection and response.
- Be the subject matter experts on big data analytics and automation
- Participate in special projects, as needed, and perform other duties as assigned
- Produce System Analytics to prove automation behaviour assumptions
- Document all system changes in line with Change Management good practices
- Recommend, Develop and Release new Use Cases to maximize the benefits and efficiencies from a SOAR platform.
- Mentor junior members of the SOAR team.
- Complete Quality Assurance on work completed by other members of the team before it is implemented in production.
Skills, Knowledge and Expertise
- Experience with Splunk, Splunk Enterprise Security, Splunk SOAR (Formerly Splunk Phantom) and Splunk User Behaviour Analytics
- Develop, and implement automations for detection and response.
- Produce System Analytics to prove automation behaviour assumptions
- A passion for security automation and a solid understanding of security incident response
- Knowledge of security frameworks including MITRE ATT&CK, NIST, etc.
- Working experience and knowledge of operating systems (e.g.: Windows, UNIX/Linux) and databases
- Knowledge in various scripting and programming languages (Java, Perl, R, Python, C++)
- Understanding of NIS regulations
- Understanding of CNI and ideally the Energy Sector. Ideally having worked on a CNI environment/client.
- Understanding of NCSC CAF and IT/OT controls such as NIST
- Integration of SOAR (Splunk) with OT specific IDS such as Nozomi, Claroty, Dragos, etc.
- Playbook development.
How we rate this
SOAR Engineer (SPLUNK) at NCC Group rates 10 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.
Little AI. AI is not part of the work.
- ●●●● Builds AI80 to 100
- ●●●○ Works on AI60 to 79
- ●●○○ Uses AI40 to 59
- ●○○○ Little AI0 to 39
Levels come from how often the tools, models and workflows of the role are named in the posting itself. Open the description and count.
Prepare for this job
A free preview built only from this posting: what it asks for, what you could be asked in an interview, and how to adjust your resume.
Skills and AI tools this role asks for
Questions you could be asked
- Tell me about a project where security automation was part of your work. What did you do?
- Tell me about a project where incident response was part of your work. What did you do?
- Tell me about a project where big data analytics was part of your work. What did you do?
- Tell me about a project where playbook development was part of your work. What did you do?
- Tell me about a project where scripting was part of your work. What did you do?
Adapt your resume
- List these exact terms on your resume: Security Automation, Incident Response, Big Data Analytics, Playbook Development, and Scripting. An applicant tracking system matches the wording, not the idea.
- Attach one line of real, concrete experience to at least one of them — a tool named with nothing behind it rarely survives a human read.
Want an expert to read your CV for this job?
Free. Send your CV and the role you want next. We reply by email within 2 to 4 business days.
Get a free CV reviewGet new remote AI jobs by email
One email a week with the new remote AI jobs, each rated for how much AI is in the work. No recruiter spam, unsubscribe in one click.
Free. One email a week. Unsubscribe in one click.
Similar roles
Software Engineering roles that involve little AI, at other companies.
What kind of AI work fits you?
Answer 12 practical questions in about three minutes. Get a simple profile, the work it points to, and live roles to explore next.
Find my next step