SOAR Engineer

Location: Mutilva, Spain

Thales people architect identity management and data protection solutions at the heart of digital security. Business and governments rely on us to bring trust to the billions of digital interactions they have with people. Our technologies and services help banks exchange funds, people cross borders, energy become smarter and much more. More than 30,000 organizations already rely on us to verify the identities of people and things, grant access to digital services, analyze vast quantities of information and encrypt data to make the connected world more secure.

Thales in Spain is a leader in technological solutions applied to Defence, Aeronautics, Security, Transportation and Space and, furthermore, is a global centre for excellence in Space, Security of Critical Infrastructures and Transportation. With a turnover of €320 million and a staff of 1,200, it exports approximately 40% of its total production principally to the Middle East, North Africa and Latin America.

We are seeking a skilled SOC Automation Engineer to drive the evolution of our Security Operations through code. In this role, you will be responsible for transforming manual detection and response workflows into automated, scalable processes. You will bridge the gap between security analysis and software engineering, building the connective tissue between our security stack and automated response playbooks to reduce Mean Time to Respond (MTTR).Job Responsabilities:SOAR Development: Design, build, and maintain automated playbooks within Cortex XSOAR and Google SecOps (Chronicle) to streamline incident response. Custom Tooling: Develop custom scripts and microservices using Python, Bash, and Go to integrate disparate security tools and automate repetitive tasks. Detection as Code: Collaborate with the SOC team to implement detection logic and CI/CD pipelines for security content. API Integration: Build and optimize integrations between SIEM, EDR, and third-party threat intelligence feeds via REST APIs. Process Optimization: Analyze existing manual investigation steps and engineer automated solutions that minimize human intervention and false positives.Years of Experience: 2Languages: EN - C1Availability to Travel: LowJob Requirements: Proven Experience: Minimum 3+ years in security automation, SecOps, or a DevOps role focused on security. Coding Proficiency: Advanced expertise in Python (required), with strong capabilities in Bash and/or Go. Platform Mastery: Hands-on experience with Cortex XSOAR or Google SecOps (highly preferred); experience with other platforms like Splunk Phantom or Swimlane is a plus. Security Mindset: Solid understanding of the incident response lifecycle, MITRE ATT&CK framework, and cloud security environments. Infrastructure: Familiarity with Docker, Kubernetes, and version control (Git).Education and Training Skills: ANY

At Thales we provide CAREERS and not only jobs. With Thales employing 80,000 employees in 68 countries our mobility policy enables thousands of employees each year to develop their careers at home and abroad, in their existing areas of expertise or by branching out into new fields. Together we believe that embracing flexibility is a smarter way of working. Great journeys start here, apply now!