Engineer, NCC Group

• The role requires a technically strong Splunk engineer with experience in SOAR development, Splunk architecture, and security engineering best practices
• Experience with AI‑enabled SOC capabilities, AI security tools, or AI‑assisted development is a strong advantage as we continue to evolve our automation and detection capabilities
• Proven experience as a Splunk Engineer, Splunk SOAR Engineer, or similar security automation role
• Strong hands‑on experience developing and managing Splunk SOAR playbooks
• Solid understanding of Splunk platform architecture, including:
• Search heads, indexers, forwarders
• Data ingestion and performance considerations
• Strong experience using Splunk SPL (Search Processing Language)
• Experience integrating Splunk SOAR with security tools such as SIEM, IAM, EDR, firewalls, and ticketing platforms
• Strong understanding of security engineering best practices, including incident response and automation safety
• Good understanding of security governance, policies, and control frameworks
• General understanding of software development practices, including:
• Version control systems (e.g. Git)
• Code review and release controls
• Familiarity with CI/CD pipelines and deployment workflows
• Ability to work independently and take ownership of delivery and outcomes
• Strong customer‑facing skills, able to communicate clearly and confidently with technical and non‑technical audiences
• Highly organised, with the ability to manage your own workload and priorities effectively
• Analytical and methodical approach to problem‑solving and automation design
• Proactive mindset with a focus on continuous improvement
• Comfortable operating in fast‑paced, security‑critical environments
• Collaborative team player with a strong sense of ownership and accountability

Desirable

• Fixed Term Contract
• We are seeking an experienced Splunk Engineer to help design, build, and manage our Splunk SOAR service, with a strong focus on automation, security response, and service maturity
• This role will be responsible for developing, reviewing, testing, and deploying Splunk SOAR playbooks into production environments, ensuring they are secure, reliable, and aligned with security governance and operational needs
• You will work closely with SOC teams, security engineers, and customers, owning your own workload and providing high‑quality delivery in a customer‑facing environment
• Own the build, operation, and continuous improvement of the Splunk SOAR service
• Design, develop, review, and maintain Splunk SOAR playbooks to support security detection, investigation, and response
• Translate security use cases, incidents, and operational requirements into effective automated workflows
• Test SOAR playbooks thoroughly and manage controlled deployment into production environments
• Ensure playbooks and integrations follow security engineering best practices and governance requirements
• Work closely with SOC analysts, security engineering teams, and stakeholders to optimise automation outcomes
• Perform playbook tuning, troubleshooting, and enhancements to improve reliability and response times
• Maintain clear technical documentation for playbooks, integrations, and processes
• Support live security operations where SOAR automation is involved
• Manage your own queue of work, prioritising tasks and communicating progress effectively
• Engage directly with customers, providing technical guidance, support, and assurance

• 1. Screening call with your Talent Acquisition Team
• 2. First Stage Interview
• 3. Second Stage Interview
• 4. Offer