SOAR Playbook Engineer

NCC Group is hiring an SOAR Playbook Engineer in Madrid, Spain. Level rates it ; you can apply on Level.

AI in this role

As an MXDR SOAR Engineer, you design, develop, maintain and optimise security automation solutions using Splunk SOAR and similar automation platforms. Your primary focus is playbook engineering, Python development, API integrations, and automated incident response workflows.

In addition to automation engineering, you are responsible for deploying, maintaining and continuously improving MXDR solutions for our customers. You assess customer requirements, collaborate with stakeholders across technical and business functions, and help ensure their environments remain secure, resilient, and operationally effective.

You act as the technical authority for Splunk SOAR, supporting customers and internal teams by translating operational requirements into scalable automations. Experience with Splunk SOAR is essential.

This role requires a broad combination of engineering, consultancy, and customer-facing skills. A strong technical foundation, excellent communication skills, and a passion for continuous learning are essential. We are looking for someone with experience across MXDR technologies, as well as a solid understanding of security monitoring, detection engineering, incident response, and platform integrations.

As a customer-facing professional, you should be confident engaging with stakeholders at all organisational levels, both remotely and in person. As part of a global organisation, proficiency in written and spoken English is required.

Key Responsibilities

• Design, develop, test and maintain Splunk SOAR playbooks.
• Develop custom Python automations and API integrations.
• Build enrichment, investigation, containment and remediation workflows.
• Troubleshoot playbook, connector and integration issues.
• Integrate Splunk SOAR with security, cloud and ITSM platforms.
• Improve automation coverage, reduce analyst effort and lower MTTR.
• Maintain documentation, code repositories and engineering standards.
• Act as the Splunk SOAR SME for customers and internal teams.

Skills, Knowledge and Expertise

• Strong hands-on Splunk SOAR engineering experience.
• Advanced Python development skills including REST APIs, JSON processing, testing and debugging.
• Experience developing and maintaining production Splunk SOAR playbooks.
• Experience with SIEM tools such as Splunk Enterprise Security and notable event workflows.
• Experience using Git and software development best practices.
• Strong understanding of SOC operations and incident response.
• Excellent customer-facing communication and consultancy skills.
• Knowledge of Microsoft Defender, CrowdStrike and SentinelOne integrations is desirable.

How we rate this

SOAR Playbook Engineer at NCC Group rates 46 out of 100 for how much of the daily work is AI. That makes it Uses AI (AI Level 2 of 4). The level is about AI in the job, not seniority.

Classification

Uses AI. An ordinary role that requires AI tools.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Open the description and count.

Key facts

SOAR Playbook Engineer is an open job at NCC Group.
Level rates this role AI Level 2 of 4: Uses AI.
The role is based in Madrid, Community of Madrid.
The job was posted on October 8, 2026.
Applications are handled by NCC Group. Apply on NCC Group

Get new software engineering jobs (Uses AI ●●○○ or higher) by email

One email a week with the new software engineering jobs (Uses AI ●●○○ or higher), each rated for how much AI is in the work. No recruiter spam, unsubscribe in one click.

Free. One email a week. Unsubscribe in one click.