SOAR Engineer
Warwick, GB, CV34 6DA
£65,000 - £70,000 DOE + benefits
Warwick, hybrid, flexible
At National Gas, the work we do matters.
As Britain's national gas network, we help keep the lights on, businesses running, and homes warm by maintaining the critical infrastructure that transports gas across Great Britain. While providing the energy security Britain relies on today, we're also helping transform the network for a clean energy future.
Join us and help secure Britain's energy.
About the role:
A crucial part of our Cyber Threat Detection team, the SOAR Engineer (security orchestration and automated response) ensures that National Gas can continuously keep up-to-date with new and emerging threats and ensures we can detect and respond to them.
- Enable the Cyber Security Operations Centre (CSOC) to detect threats targeting the organisation through enrichment, tuning and automation, allowing the CSOC to be more effective.
- Mature the cyber security posture of the business by leveraging automation and orchestrated response.
Key accountabilities:
- Subject Matter Expert for all things Threat Detection and security automation across the business.
- Analyse workflows and create automations to improve speed and efficiency.
- Develop tailored automations and enrichments for alerts/incidents across a wide range of security tools.
- Lead the design, development, and engineer new content (playbooks) across our security orchestration and response (SOAR) and security information and event management (SIEM) platforms to meet the organisation’s strategic objectives and goals.
- Assist with managing the Engineering backlog including researching backlog items, updating items, collecting requirements, feedback, etc and coming prepared to backlog refinement.
- Conduct in-depth analysis of the existing functionality of the CSOC, propose and enact improvements to the service.
About you:
- Strong proficiency in KQL and detection engineering.
- Have a high level of ability to create and develop security orchestration and automated response (SOAR).
- Experience and working knowledge with operating systems – both Linux and Windows platforms.
- Extensive knowledge of Azure including Azure functions and Logic Apps.
- Familiarity with programming languages such as Python and PowerShell.
- Experience with cloud security tools and platforms (e.g., AWS, Azure, Microsoft 365).
- Experience working in Security Operation Centres, incident response and associated technologies.
- Understanding of REST API’s and demonstrate ability to develop and interact with REST API.
- Terraform/DevSecOps experience
- Bachelor’s degree in computer science, Cyber Security, a related field, or suitable combination of education, experience and training.
What we can offer you:
- £65,000 - £70,000 (dependant on experience)
- Market-leading double-match pension (for every £1 you add, we add £2)
- Annual performance bonus (up to 6%)
- 26 days holiday plus 8 statutory days and option to buy 5 additional days
- 10x salary life assurance and income protection
- Flexible opt-in salary sacrifice benefits including private healthcare, car, dental, and technology schemes
- Family-friendly policies, wellbeing support, and professional development opportunities
Security clearance:
This role is subject to National Security Vetting (NSV). Candidates must be eligible to obtain and maintain Security Clearance (SC) throughout their employment. For further information, visit GOV.UK (UK Security Vetting: Clearance Levels).
Inclusive recruitment:
We're building a workforce that reflects the communities we serve, championing diversity, and creating an inclusive workplace where everyone is valued for their unique contribution. We support reasonable adjustments throughout the recruitment process and beyond.
National Gas is a Disability Confident employer and signatory of the Armed Forces Covenant.
#LI-PT1 #LI-Hybrid
Further information:
- Please note: there may be a requirement in the future for this position to be part of an on-call rota to support business continuity and respond to critical security incidents, further detail can be provided if selected for interview.
- Advert close: 29th September 2026
- Interviews: w/c 5th October 2026