Google SecOps Engineer (SIEM & SOAR)

Role & responsibilities

• Manage, configure, troubleshoot, and optimize Google SecOps (Chronicle SIEM & SOAR).
• Investigate and resolve complex issues across log ingestion, parsing, UDM mapping, detections, alerts, and automation workflows.
• Perform end-to-end root cause analysis and implement sustainable fixes.
• Onboard and validate security telemetry from cloud, network, endpoint, identity, and application sources.
• Develop and maintain custom parsers and ensure accurate UDM normalization.
• Create, tune, and optimize YARA-L detections and threat hunting content.
• Design, develop, and support SOAR playbooks, integrations, APIs, and automation workflows.
• Support SOC teams with advanced investigations, incident response, and technical escalations.
• Monitor platform performance, data quality, detection effectiveness, and automation success rates.
• Maintain technical documentation, RCA reports, and engineering best practices.

Preferred candidate profile

• 5+ years of experience in SIEM, SOC Engineering, Security Engineering, or Cybersecurity Operations.
• Strong hands-on experience with Google SecOps / Google Chronicle.
• Proven expertise in troubleshooting log ingestion, parsing, detections, and SOAR workflows.
• Experience developing parsers, detection rules, and security automation.
• Strong understanding of security technologies such as EDR, IAM, firewalls, WAF, cloud security, and threat intelligence.
• Good knowledge of APIs, JSON, Syslog, Windows/Linux logs, networking, and authentication protocols.
• Basic scripting skills in Python, PowerShell, or similar languages.
• Ability to analyze raw logs and troubleshoot issues across the complete security data pipeline.
• Strong problem-solving, analytical thinking, and root cause analysis skills.
• Relevant Google Cloud, Google SecOps, or cybersecurity certifications are highly desirable.