SOAR Contract Job Trends

Security Orchestration, Automation and Response (SOAR)
UK

The table below provides summary statistics and contractor rates for jobs requiring SOAR skills. It covers contract job vacancies from the 6 months leading up to 21 December 2025, with comparisons to the same periods in the previous two years.

6 months to
21 Dec 2025
Same period 2024 Same period 2023
Rank 408 475 521
Rank change year-on-year +67 +46 +220
Contract jobs citing SOAR 181 60 82
As % of all contract jobs in the UK 0.49% 0.18% 0.19%
As % of the Processes & Methodologies category 0.56% 0.20% 0.21%
Number of daily rates quoted 109 33 62
10th Percentile £400 £508 £413
25th Percentile £463 £575 £500
Median daily rate (50th Percentile) £559 £600 £575
Median % change year-on-year -6.76% +4.35% -3.16%
75th Percentile £650 £775 £650
90th Percentile £710 £795 £725
UK excluding London median daily rate £540 £713 £550
% change year-on-year -24.25% +29.61% -7.37%
Number of hourly rates quoted 13 0 0
10th Percentile £42.55 - -
25th Percentile £45.00 - -
Median hourly rate £65.00 - -
75th Percentile £75.00 - -
90th Percentile £84.75 - -
UK excluding London median hourly rate £65.00 - -

All Process and Methodology Skills
UK

SOAR falls under the Processes and Methodologies category. For comparison with the information above, the following table provides summary statistics for all contract job vacancies requiring process or methodology skills.

Contract vacancies with a requirement for process or methodology skills 32,432 29,959 38,773
As % of all contract IT jobs advertised in the UK 88.29% 88.23% 88.50%
Number of daily rates quoted 20,397 18,286 25,908
10th Percentile £300 £307 £306
25th Percentile £406 £413 £420
Median daily rate (50th Percentile) £500 £525 £530
Median % change year-on-year -4.76% -0.94% -3.64%
75th Percentile £615 £638 £650
90th Percentile £723 £743 £744
UK excluding London median daily rate £475 £500 £500
% change year-on-year -5.00% - -
Number of hourly rates quoted 2,093 972 1,488
10th Percentile £14.51 £15.62 £14.33
25th Percentile £17.50 £20.30 £18.99
Median hourly rate £25.15 £32.50 £43.84
Median % change year-on-year -22.62% -25.86% +25.25%
75th Percentile £50.00 £62.50 £65.00
90th Percentile £68.00 £73.75 £77.50
UK excluding London median hourly rate £23.00 £31.50 £44.50
% change year-on-year -26.98% -29.21% +39.26%

SOAR
Job Vacancy Trend

Historical trend showing the proportion of contract IT job postings citing SOAR relative to all contract IT jobs advertised.

SOAR job vacancy trend in the UK

SOAR
Daily Rate Trend

Contractor daily rate distribution trend for jobs in the UK citing SOAR.

Contractor daily rate distribution trend for jobs in the UK citing SOAR

SOAR
Daily Rate Histogram

Daily rate distribution for jobs citing SOAR over the 6 months to 21 December 2025.

Daily rate histogram for SOAR in the UK

SOAR
Hourly Rate Trend

Contractor hourly rate distribution trend for jobs in the UK citing SOAR.

Contractor hourly rate distribution trend for jobs in the UK citing SOAR

SOAR
Hourly Rate Histogram

Hourly rate distribution of jobs citing SOAR over the 6 months to 21 December 2025.

Hourly rate histogram for SOAR in the UK

SOAR
Top 15 Contract Job Locations

The table below looks at the demand and provides a guide to the median contractor rates quoted in IT jobs citing SOAR within the UK over the 6 months to 21 December 2025. The 'Rank Change' column provides an indication of the change in demand within each location based on the same 6 month period last year.

Location Rank Change
on Same Period
Last Year
Matching
Contract
IT Job Ads
Median
Daily Rate
Past 6 Months
Median Daily Rate
% Change
on Same Period
Last Year
Live
Jobs
England +73 161 £567 -5.46% 24
UK excluding London +40 94 £540 -24.25% 23
London +24 58 £588 +2.17% 8
Work from Home +20 52 £550 -8.33% 12
East of England - 26 £650 - 4
Midlands -22 25 £517 -33.07% 2
West Midlands -19 22 £520 -32.69% 1
South East +3 20 £650 +8.33% 9
North of England -25 15 £520 -20.00% 6
North West -22 8 £55 - 4
Yorkshire -39 6 £529 -18.65% 2
South West -15 5 £575 -9.85% 2
Scotland - 4 £454 -
East Midlands - 3 £375 - 1
North East - 1 £400 -

SOAR
Co-Occurring Skills & Capabilities by Category

The following tables expand on the one above by listing co-occurrences grouped by category. They cover the same employment type, locality and period, with up to 20 co-occurrences shown in each category:

Application Platforms
1 3 (1.66%) Microsoft Exchange
2 2 (1.10%) Confluence
3 1 (0.55%) Jupyter
Applications
1 2 (1.10%) Microsoft Excel
2 1 (0.55%) Microsoft Office
Cloud Services
1 72 (39.78%) Azure
2 56 (30.94%) Azure Sentinel
3 45 (24.86%) AWS
4 27 (14.92%) GCP
5 14 (7.73%) Azure Logic Apps
6 13 (7.18%) Microsoft 365
7 11 (6.08%) Azure Monitor
7 11 (6.08%) Entra ID
8 10 (5.52%) Microsoft Purview
9 6 (3.31%) Cloudflare
9 6 (3.31%) SaaS
10 5 (2.76%) OpenDNS
11 4 (2.21%) GitHub
11 4 (2.21%) IaaS
11 4 (2.21%) PaaS
12 3 (1.66%) Azure DevOps
12 3 (1.66%) OCI
12 3 (1.66%) Serverless
13 2 (1.10%) Power Platform
14 1 (0.55%) Amazon Macie
Communications & Networking
1 50 (27.62%) Firewall
2 27 (14.92%) DNS
3 24 (13.26%) Network Security
4 19 (10.50%) HTTP
5 13 (7.18%) FTP
5 13 (7.18%) SMTP
5 13 (7.18%) SSL
6 9 (4.97%) TCP/IP
7 6 (3.31%) VPN
8 5 (2.76%) DHCP
9 3 (1.66%) Internet
10 2 (1.10%) Reverse Proxy
11 1 (0.55%) DKIM
11 1 (0.55%) DMARC
11 1 (0.55%) Intrusion Detection
11 1 (0.55%) Modbus
11 1 (0.55%) NAS
11 1 (0.55%) tcpdump
11 1 (0.55%) Wireless
11 1 (0.55%) Wireshark
Database & Business Intelligence
1 9 (4.97%) Data Lake
2 4 (2.21%) Elasticsearch
2 4 (2.21%) SQL Server
3 2 (1.10%) BigQuery
3 2 (1.10%) Power BI
4 1 (0.55%) Big Data
Development Applications
1 6 (3.31%) JIRA
2 4 (2.21%) Git
3 2 (1.10%) Jenkins
3 2 (1.10%) Metasploit
4 1 (0.55%) GitLab
4 1 (0.55%) MLflow
General
1 69 (38.12%) Social Skills
2 40 (22.10%) Analytical Skills
3 17 (9.39%) Public Sector
4 12 (6.63%) Finance
5 9 (4.97%) Documentation Skills
6 3 (1.66%) Banking
6 3 (1.66%) Military
6 3 (1.66%) Presentation Skills
7 2 (1.10%) Investment Banking
7 2 (1.10%) Legal
7 2 (1.10%) Retail
8 1 (0.55%) Aerospace
8 1 (0.55%) Inclusion and Diversity
8 1 (0.55%) Telecoms
Job Titles
1 44 (24.31%) Analyst
1 44 (24.31%) Security Engineer
2 28 (15.47%) SOC Analyst
3 23 (12.71%) Architect
3 23 (12.71%) Senior
4 15 (8.29%) Security Analyst
5 14 (7.73%) Cybersecurity Engineer
6 13 (7.18%) Automation Engineer
7 12 (6.63%) SIEM Engineer
8 11 (6.08%) Operations Analyst
9 9 (4.97%) Consultant
10 8 (4.42%) Security Operations Analyst
10 8 (4.42%) Senior Security Engineer
10 8 (4.42%) SOC Manager
11 7 (3.87%) Lead
11 7 (3.87%) Security Architect
11 7 (3.87%) Security Consultant
12 6 (3.31%) Developer
13 5 (2.76%) Azure Engineer
13 5 (2.76%) Cloud Engineer
Libraries, Frameworks & Software Standards
1 22 (12.15%) REST
2 13 (7.18%) LDAP
3 8 (4.42%) JSON
4 5 (2.76%) SOAP
5 4 (2.21%) Elastic Stack
5 4 (2.21%) YAML
6 3 (1.66%) Kafka
6 3 (1.66%) Regular Expression
7 2 (1.10%) .NET
7 2 (1.10%) ADO
7 2 (1.10%) gRPC
7 2 (1.10%) React
7 2 (1.10%) XML
8 1 (0.55%) Apache NiFi
8 1 (0.55%) Azure Blueprints
8 1 (0.55%) eBPF
8 1 (0.55%) Fluent Bit
8 1 (0.55%) Lucene
8 1 (0.55%) PyTorch
8 1 (0.55%) TensorFlow
Miscellaneous
1 44 (24.31%) Security Operations Centre
2 27 (14.92%) Onboarding
3 22 (12.15%) Cyber Threat
4 18 (9.94%) Security Posture
5 17 (9.39%) Operational Technology
6 16 (8.84%) Analytical Mindset
7 14 (7.73%) Cyberattack
8 13 (7.18%) CSOC
8 13 (7.18%) Management Information System
9 9 (4.97%) Cloud Native
10 8 (4.42%) YARA
11 7 (3.87%) Linux Command Line
12 6 (3.31%) Public Cloud
13 5 (2.76%) Cyber Kill Chain
13 5 (2.76%) PKI
14 4 (2.21%) STIX
15 3 (1.66%) Cloud Security Posture
15 3 (1.66%) CMDB
15 3 (1.66%) Cyber Defence
15 3 (1.66%) Hybrid Cloud
Operating Systems
1 47 (25.97%) Windows
2 43 (23.76%) Linux
3 13 (7.18%) Red Hat Enterprise Linux
4 10 (5.52%) Unix
5 6 (3.31%) Windows Server
6 1 (0.55%) Mac OS X
Processes & Methodologies
1 159 (87.85%) SIEM
2 94 (51.93%) Incident Response
3 85 (46.96%) Cybersecurity
4 81 (44.75%) Security Operations
5 68 (37.57%) Threat Detection
6 53 (29.28%) MITRE ATT&CK
7 42 (23.20%) Cloud Security
7 42 (23.20%) Threat Intelligence
8 37 (20.44%) Analytics
8 37 (20.44%) Security Monitoring
9 36 (19.89%) Use Case
10 33 (18.23%) Vulnerability Management
11 30 (16.57%) Cyber Threat Intelligence
12 26 (14.36%) Information Security
13 25 (13.81%) Continuous Improvement
13 25 (13.81%) Root Cause Analysis
14 23 (12.71%) Threat Modelling
15 22 (12.15%) Infrastructure as Code
15 22 (12.15%) Runbook
16 21 (11.60%) AI
Programming Languages
1 98 (54.14%) Python
2 82 (45.30%) PowerShell
3 32 (17.68%) Kusto Query Language
4 19 (10.50%) Bash
5 7 (3.87%) Bicep
6 4 (2.21%) Shell Script
7 3 (1.66%) Search Processing Language
8 2 (1.10%) Java
8 2 (1.10%) PHP
8 2 (1.10%) TypeScript
9 1 (0.55%) R
9 1 (0.55%) SQL
Qualifications
1 49 (27.07%) Security Cleared
2 43 (23.76%) SC Cleared
3 18 (9.94%) Degree
4 15 (8.29%) CISSP
4 15 (8.29%) GCIH
5 13 (7.18%) DV Cleared
6 12 (6.63%) Azure Certification
7 11 (6.08%) GCIA
8 10 (5.52%) CompTIA Security+
9 8 (4.42%) CEH
10 7 (3.87%) Cisco Certification
10 7 (3.87%) Computer Science Degree
11 6 (3.31%) CISM
11 6 (3.31%) GIAC
12 5 (2.76%) (ISC)2 CCSP
13 4 (2.21%) SSCP
14 3 (1.66%) CompTIA CySA+
14 3 (1.66%) GCFA
15 2 (1.10%) AWS Certification
16 1 (0.55%) CRISC
Quality Assurance & Compliance
1 43 (23.76%) NIST
2 27 (14.92%) ISO/IEC 27001
3 19 (10.50%) GDPR
4 14 (7.73%) HIPAA
5 11 (6.08%) PCI DSS
6 6 (3.31%) NCSC
7 3 (1.66%) GRC
7 3 (1.66%) NIST 800
7 3 (1.66%) SOC 2
8 2 (1.10%) Disclosure Scotland
8 2 (1.10%) SLA
9 1 (0.55%) Cyber Essentials
9 1 (0.55%) Data Quality
9 1 (0.55%) EU AI Act
9 1 (0.55%) Government Security Classifications
9 1 (0.55%) GPG13
9 1 (0.55%) Sarbanes-Oxley
System Software
1 17 (9.39%) Active Directory
2 7 (3.87%) Docker
3 6 (3.31%) Snort
4 5 (2.76%) Hyper-V
4 5 (2.76%) Squid
5 4 (2.21%) VMware Infrastructure
Systems Management
1 11 (6.08%) Kubernetes
1 11 (6.08%) QRadar
2 9 (4.97%) Terraform
3 8 (4.42%) Nessus
4 5 (2.76%) Nexpose
4 5 (2.76%) Suricata
5 4 (2.21%) Fluentd
6 3 (1.66%) Active Directory Federation Services
6 3 (1.66%) Ansible
6 3 (1.66%) logstash
7 2 (1.10%) Demisto
7 2 (1.10%) Single Sign-On
8 1 (0.55%) CASB
8 1 (0.55%) CSIRT
8 1 (0.55%) Jamf Pro
8 1 (0.55%) Kibana
8 1 (0.55%) Kubeflow
8 1 (0.55%) Rsyslog
8 1 (0.55%) SCCM
8 1 (0.55%) WSUS
Vendors
1 72 (39.78%) Microsoft
2 56 (30.94%) Splunk
3 25 (13.81%) Google
4 22 (12.15%) Palo Alto
5 18 (9.94%) CrowdStrike
6 12 (6.63%) ServiceNow
7 11 (6.08%) Qualys
8 10 (5.52%) Cisco
8 10 (5.52%) Tenable
9 9 (4.97%) CyberArk
10 8 (4.42%) BeyondTrust
10 8 (4.42%) LogRhythm
11 7 (3.87%) Carbon Black
11 7 (3.87%) FireEye
12 6 (3.31%) McAfee
12 6 (3.31%) Zscaler
13 5 (2.76%) Blue Coat
13 5 (2.76%) Darktrace
13 5 (2.76%) Rapid7
13 5 (2.76%) VMware