SOAR Automation Engineer

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission‑critical systems across on‑site, hybrid, and fully remote environments.

This SOAR Automation Engineer role supports a large U.S. federal agency by designing, implementing, and scaling security automation capabilities across a complex enterprise environment. The role is centered on Splunk Phantom (Splunk SOAR) and focuses on automating security operations, improving response and investigation workflows, and integrating AI‑enabled enrichment using Azure AI services where appropriate.

This is a hands‑on technical role with strategic influence, combining deep engineering work with ownership of automation design and continuous improvement across SOC workflows.

This is a W2 contract, fully remote (CONUS only) role, supporting a large federal agency. Prior federal contracting experience is preferred.

U.S. Citizenship or Permanent Residency is required.

• Design, build, and maintain SOAR automation using Splunk Phantom
• Develop and enhance automated playbooks to support detection, response, and investigation workflows
• Integrate SOAR with SIEM, security tools, cloud platforms, and on‑prem systems
• Apply AI‑enabled enrichment and decision support using Azure AI services
• Lead automation design decisions and guide SOC teams on effective SOAR usage
• Improve dashboards, metrics, and operational visibility tied to automated workflows
• Collaborate with security analysts, engineers, and stakeholders to identify automation opportunities
• Operationalize and scale automation across the security lifecycle
• Ensure reliability, maintainability, and documentation of automation solutions

Must-Have

• 4+ years of experience building and supporting SOAR / security automation solutions in enterprise environments
• Hands‑on experience with Splunk Phantom (Splunk SOAR)
• Strong background in security workflow automation and playbook development
• Experience integrating cloud and on‑premise systems via APIs
• Working familiarity with Azure AI services and applied AI use cases in cybersecurity
• Strong problem‑solving and analytical skills
• Ability to collaborate across technical and non‑technical teams
• Excellent written and verbal communication skills
• Bachelor’s degree in a cyber‑related field or equivalent experience/certifications

Nice-To-Have

• Federal cybersecurity environments
• SOC operations and incident response workflows
• Python or scripting for automation
• SIEM integration (Splunk Enterprise / Splunk ES)
• Familiarity with NIST cybersecurity frameworks

• Expertise in SOAR and AI technologies
• Strong technical and analytical skills
• Ability to work collaboratively with security teams
• Proficiency in developing automated security workflows
• Experience with cloud and on‑premise system integration
• Strong communication and planning abilities
• Problem‑solving and critical thinking skills
• Familiarity with cybersecurity frameworks and standards

• Insurance – health, dental, and vision
• Paid Time Off (PTO) and 11 Federal Holidays
• 401(k) employer match

Mid‑Senior level

Full‑time

Engineering and Information Technology

IT Services and IT Consulting