Job Description & Details
This is a heavy-hitting Senior SOAR Developer role meant for someone who wants to completely strip the manual tedium out of Security Operations Center workflows. You'll be working directly inside a DevSecOps model to modernize how security telemetry is processed and automated, meaning you aren't just writing scripts in a silo—you are actively collaborating with incident responders through the entire lifecycle. If you enjoy building resilient automation pipelines and hate repetitive manual tasks, this one is worth a serious look.
What You'll Actually Be Doing
Expect to spend your days knee-deep in process mapping, API integrations, and automation playbook authoring. You'll be building custom applications to handle SOC workflows, integrating the SOAR platform with a variety of security tools via REST APIs, and troubleshooting technical bottlenecks across the entire SDLC. A huge part of the gig is also mentoring the broader SOC team on processes, governance, and frameworks, so you'll need to communicate clearly with both engineers and system administrators.
The Core Tech Stack
Python is your bread and butter here, alongside robust experience with major SOAR platforms like Swimlane, Phantom, or XSOAR. You'll also need a solid grasp of REST APIs, JSON, and JavaScript for crafting reusable automation logic, plus working familiarity with SIEM tools like Splunk or XSIAM. Because this environment requires you to understand the why behind every security alert rather than just clicking buttons, a strong foundational background in network security and incident response is non-negotiable.
Interview Expectations
Expect the hiring team to hand you a messy, multi-step incident response scenario and ask you to whiteboard a SOAR playbook for it on the fly; they want to see if your automation logic handles edge cases and API failures gracefully rather than just covering the happy path. You should also be ready to discuss a time you optimized a bloated script or process, as they are actively hunting for developers who genuinely understand how to reduce noise in a high-alert SOC.
Application Advice
Your resume needs to scream automation and process optimization right out of the gate. Do not just list tools like Python and XSOAR; use specific metrics to show how your playbooks reduced mean time to respond (MTTR) or eliminated manual triage steps in past roles. Make sure keywords like 'DevSecOps', 'REST APIs', 'Incident Response', and 'SOP Playbooks' are explicitly visible to glide past the initial ATS screening.