Your ImpactWe are looking for a Lead Service Manager (SOAR) to reduce analyst manual workloads and increase the speed and consistency of our Managed Security Services (MSS) operations through automation, orchestration, and applied AI. This role is critical to turning manual, repetitive SOC tasks into reliable automated workflows, and to implementing practical AI use cases that free analysts to focus on higher-value work across our 247 multi-tenant MxDR environment and wider MSS. The ideal candidate will combine solid security engineering discipline with a genuine understanding of where automation delivers the most value.
What the role offers:As a Lead Service Manager, you will:- Identify and prioritize the highest-volume, most repetitive SOC tasks for automation (alert triage, enrichment, case creation, notification, and containment), applying a clear cost-benefit calculus to what is automated and at what level of autonomy.
- Design, build, test, and maintain SOAR playbooks and integrations on our approved SOAR, spanning the SIEM, EDR, threat intelligence, case management, identity, productivity and collaboration tooling.
- Implement practical AI use cases across the SOC, including alert summarization, enrichment, triage assistance, and drafting of analyst and client-facing content, with appropriate guardrails and human oversight.
- Integrate and orchestrate tooling via APIs, webhooks, and structured data, building maintainable connectors across the security stack.
- Build feedback loops so that automated actions generate data that feeds detection tuning and continuous improvement.
- Partner with wider MSS teams and specialists to translate manual runbooks into automated workflows with clear human-in-the-loop and human-on-the-loop checkpoints and handoff triggers.
- Support the safe, governed operation of agentic AI capability, including validation, guardrails, and monitoring of machine-generated output before it is acted on.
- Establish standards, version control, testing, and documentation for automation content so that playbooks are reliable, maintainable, and auditable.
- Measure and report automation impact, including improvements to mean time to triage, mean time to respond, analyst hours saved, false-positive reduction, and playbook coverage.
What you need to Succeed:- 5+ years of Security Engineering, SecDevOps, and automation experience delivering and maintaining production-grade security solutions.
- Hands-on SOAR expertise building and managing playbooks, integrations, and automated response workflows across complex security environments.
- Strong Python development skills with experience in REST APIs, JSON, webhooks, API integrations, data transformation, and automation frameworks.
- Deep understanding of SOC operations, alert lifecycle management, and automation opportunities across triage, enrichment, containment, and response.
- Experience integrating and managing SIEM, EDR, identity, threat intelligence, case management, and collaboration platforms through APIs and automation frameworks.
- Knowledge of Docker, Kubernetes, Git, testing, peer review, documentation, and security engineering best practices.
- Experience applying AI, LLMs, and agentic AI frameworks to security workflows, including prompt engineering, guardrails, evaluation, and operational safety.
- Experience supporting Azure, AWS, and GCP environments within multi-tenant managed services or MDR organizations; familiarity with Devo, Microsoft Sentinel, Splunk, QRadar, FortiSOAR, SplunkSOAR, Cortex XSOAR, Swimlane, SentinelOne, and CrowdStrike. GIAC GPYC and other cloud/security automation certifications are an asset.
Compensation: At OpenText, we offer a thoughtfully designed benefits package that supports your physical, emotional, and financial wellbeing. As you move through the hiring process, we9re happy to provide more details about our compensation programs, including variable and commission compensation opportunities for eligible roles, vacation entitlement, and paid time off.
Salary Range: $86,800.00 - $130,200.00; Depending on the candidate9s education, experience, skills, geographical location, and alignment with internal equity and external market, actual salary may vary and be higher or lower than the range posted.
