Security Orchestration, Automation and Response (SOAR) enables defenders to operate at attacker speed by codifying detection and response expertise into automation playbooks. We will examine the core components of SOAR, skills required to design and implement it, common use cases in detection and response, and potential opportunities for security control testing in a defense-in-depth environment.