Senior SOAR Engineer

Detection & Automation Engineering operates Adobe's detection and response backbone, closing the gap between detection and containment.

As a Senior SOAR Engineer, you'll build, develop, and maintain production automation playbooks that reduce mean-time-to-respond. You'll collaborate with Detection Engineering to transform new detection rules into effective response actions. You'll also assist CSIRT/SOC Operations with enrichment and correlation logic. And you'll deliver Incident Response containment playbooks for live incidents. Join us if you're ready to make a world-class impact!

• →Build, develop, and maintain SOAR playbooks that automate enrichment, correlation, and containment across the security stack.
• →Work alongside Detection Engineering for every new detection rule that calls for a response action. They outline the logic, and you build and verify the automation.
• →Support CSIRT/SOC Operations by adjusting automation related to data enrichment and event association. This reduces analyst triage time and improves signal quality.
• →Own containment and remediation automation for Incident Response, including identity- and access-related response actions used during live incidents.
• →Build and maintain policy-enforcement automation, ensuring upstream access and control decisions complete reliably, without gaps.
• →Integrate SOAR with ecosystem tooling — identity providers, endpoint/EDR, ticketing systems — using built-in apps and REST APIs, or custom connectors when they don't exist.
• →Triage production playbook issues as an operational priority, and track metrics for automation coverage, reliability, and time-to-remediate.
• →Assist in Detection-as-Code integration following Detection Engineering's current standards, and record playbook logic for collective team ownership.
• →Actively find ways to integrate AI into day-to-day work — playbook development, script writing, enrichment logic, triage, incident summarization, testing, and documentation.

Required:

• 7+ years in security engineering, security automation, or a closely related field.
• Hands-on experience building and maintaining SOAR playbooks (Splunk SOAR, Tines, XSOAR, etc.).
• Advanced proficiency in Python (or comparable scripting language) for custom actions, connectors, and playbook logic.
• Practical understanding of incident response and SOC triage workflows.
• Experience connecting SOAR with detection/SIEM platforms (Splunk or similar), identity/access solutions, and ticketing/case management systems through REST APIs.
• Ability to work independently on unstructured problems, making defensible, risk-based decisions on containment/response logic.
• Strong written and verbal communication. You'll detail playbook reasoning for engineers and explain the same tradeoffs to non-technical collaborators.
• Hands-on experience using AI-assisted development tools (e.g., Claude Code, Copilot, Cursor), and judgment on when they help.

• Experience with identity/access systems (e.g., Okta, Entra ID) for containment tasks such as session revocation or account disabling.
• Comfort with both low-code playbook building and pro-code extensions, writing custom Python when built-in logic isn't enough.
• Experience with event-driven architectures and webhook-based integrations, beyond standard polling REST calls.
• Proficiency in more than one scripting or development language (e.g., PowerShell, Bash, Go) beyond Python.
• A track record of pushing AI tooling beyond baseline usage — custom prompts, agents, or workflows for playbook and script work.
• Familiarity with Detection-as-Code practices and CI/CD for security content.
• Experience mentoring other engineers or serving as a technical point of contact for automation work.
• Background supporting compliance-relevant controls where automation failures have audit implications.
• Relevant certifications (e.g., Splunk SOAR Certified Automation Developer, GCIH, CISSP) a plus but not required.

Adobe empowers everyone to create through innovative platforms and tools that unleash creativity, productivity and personalized customer experiences. Adobe’s industry-leading offerings including Adobe Acrobat Studio, Adobe Express, Adobe Firefly, Creative Cloud, Adobe Experience Platform, Adobe Experience Manager, and GenStudio enable people and businesses to turn ideas into impact, powered by AI and driven by human ingenuity.

Our 30,000+ employees worldwide are creating the future and raising the bar as we drive the next decade of growth. We’re on a mission to hire the very best and believe in creating a company culture where all employees are empowered to make an impact. At Adobe, we believe that great ideas can come from anywhere in the organization. The next big idea could be yours. 

At Adobe, we believe in creating a company culture where all employees are empowered to make an impact. Learn more about Adobe life, including our values and culture, focus on people, purpose and community, Adobe for All, comprehensive benefits programs, the stories we tell, the customers we serve, and how you can help us advance our mission of empowering everyone to create.

Adobe is proud to be an Equal Employment Opportunity employer. We do not discriminate based on gender, race or color, ethnicity or national origin, age, disability, religion, sexual orientation, gender identity or expression, veteran status, or any other protected characteristic. Learn more.

Adobe aims to make our Careers website and recruiting process accessible to any and all users. If you have a disability or special need that requires accommodation to navigate our website or complete the application process, email accommodations@adobe.com.

At Adobe, for sales roles starting salaries are expressed as total target compensation (TTC = base + commission), and short-term incentives are in the form of sales commission plans.  Non-sales roles starting salaries are expressed as base salary and short-term incentives are in the form of the Annual Incentive Plan (AIP).

In addition, certain roles may be eligible for long-term incentives in the form of a new hire equity award.

State-Specific Notices:

Adobe will consider qualified applicants with arrest or conviction records for employment in accordance with state and local laws and “fair chance” ordinances.

Colorado:

If this role is open to hiring in Colorado (as listed on the job posting), the application window will remain open until at least the date and time stated above in Pacific Time, in compliance with Colorado pay transparency regulations. If this role does not have Colorado listed as a hiring location, no specific application window applies, and the posting may close at any time based on hiring needs.

Massachusetts:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.