Lead Security Operations Center Analyst

Must Have Technical/Functional Skills:
SIEM Technologies
• Google SecOps (Chronicle) SIEM, Security Event Monitoring, Log Analysis and Correlation, Detection Engineering, Use Case Development
SOAR Technologies
• Google SecOps SOAR, Security Orchestration and Automation, Playbook Development, API Integrations, Workflow Automation
Security Domains
• Incident Response, Threat Intelligence, Threat Hunting, Endpoint Security, Cloud Security, Vulnerability Management

Roles & Responsibilities
Technical:
• Perform investigation and escalation for complex or high severity security threats or incidents
• Security monitoring experience with one or more SIEM technologies – Google SecOps SIEM (preferable), Splunk.
• Conduct multi-step breach and investigative analysis to trace the dynamic activities associated with advanced threats
• Work with SIEM Engineering and other security partners developing and refining correlation rules
• Create and develop SOC processes and procedures working with Level 3, Level 2 and Level 1 Analysts
• Drive Use Case Roadmap development and Use Case validation
• Perform regular threat hunting utilizing security tools and intelligence information to identify and remediate potential security threats
• Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs)
• Maintain and drive the development of new reports of Cyber Threat Intelligence analysis and making threat intelligence actionable

Google SecOps Administration & Engineering
• Configure, administer, and maintain Google SecOps SIEM and SOAR platforms.
• Onboard and validate log sources from security, cloud, network, endpoint, IAM, and application environments.
• Develop and tune correlation rules and detection use cases.
• Configure threat detection content aligned with MITRE ATT&CK techniques.
• Configure parsers, ingestion pipelines, and data normalization.
• Develop and optimize detection rules, correlation rules, dashboards, and alerts.
• Support log source integrations and ensure data quality and visibility.
• Perform health checks and platform tuning to improve detection efficiency.
• Coordinate with security tool owners and infrastructure teams for log enablement and troubleshooting.

SOAR & Security Automation
• Design, develop, and maintain SOAR playbooks and automated response workflows.
• Integrate Google SecOps with security tools and third-party platforms.
• Automate repetitive SOC tasks, incident enrichment, and response activities.
• Configure orchestration workflows for malware, phishing, IAM, cloud, and endpoint incidents.
• Improve SOC efficiency through continuous automation initiatives.

Threat Detection & Threat Intelligence
• Monitor threat intelligence feeds and external security advisories.
• Tune detection logic is based on emerging threats and attack techniques.
• Configure and manage threat intelligence integrations and reputation feeds.
• Perform threat hunting activities utilizing SIEM and endpoint telemetry.
• Provide proactive threat advisories and recommendations to stakeholders.
• Analyze suspicious activities and identify security incidents.
• Classify incidents according to severity and business impact.
• Support incident response, containment, eradication, and recovery activities.
• Coordinate with infrastructure, network, cloud, IAM, and endpoint teams during investigations.

Reporting & Governance
• Prepare weekly and monthly SOC operational reports.
• Generate incident metrics, SLA reports, and executive dashboards.
• Maintain SOC runbooks, operational procedures, use-case documentation, and knowledge repositories.
• Participate in audits, compliance reviews, and security assessments.

SIEM Technologies
• Google SecOps (Chronicle) SIEM
• Security Event Monitoring
• Log Analysis and Correlation
• Detection Engineering
• Use Case Development

SOAR Technologies
• Google SecOps SOAR
• Security Orchestration and Automation
• Playbook Development
• API Integrations
• Workflow Automation