Security Engineer – SIEM Platform (Google SecOps)

• Integration of Google SecOps SIEM with other security capabilities and tools such as SOAR, EDR, NDR, threat intelligence platform, and ticketing systems.

• Write custom actions, scripts and/or integrations to extend SIEM platform functionality.

• Creation of SIEM assets such as: detection rules using YARA-L, dashboards, parsers etc.

• Extension of pre-built UDMs in Google SecOps and creation of custom parsers where required for log sources.

• Testing and deployment of newly created and migrated assets such as rules, playbooks, alerts, dashboards etc.

• Monitor performance and perform timely actions to scale SIEM deployment.

• Creation of custom SIEM dashboards to meet security requirements.

• Debug and solve customer issues in ingestion, parsing, normalization of data etc

• Develop SOAR playbooks to provide case handling and Incident response as per triage needs.

• Design and implement solutions to handle alert fatigue encountered in SIEM correlation.

L2 Incident Response (Operational Role)

• Actively participate in Security Operations activities as an L2 Incident Responder.

• Lead incidents through all stages: identification, containment, eradication, recovery, and lessons learned.

• Serve as the primary point of contact for the SOC regarding SIEM investigations, platform behavior, detection logic, and operational troubleshooting.

• Support continuous improvement by translating incident learnings into better detections, dashboards, and playbooks.

About You (Must-have experience and skills)

• Must-have experience and skills

• Minimum of 2-3 years in Cybersecurity, ideally security operations or security operation center.

• Expertise on incident management, SIEM, DLP, threat intelligence, VPN, and email security.

• Google SecOps SIEM experience in the areas of responsibility for at least 1 year.

• Experience building detection content (rule logic, correlation, tuning); YARA-L experience preferred.

• Experience integrating security tools via APIs and automation (EDR, NDR, ticketing).

• Scripting ability (e.g., Python, Bash) for automation and troubleshooting.

• Strong understanding of cybersecurity principles and best practices.

• Strong knowledge of network, endpoint, identity, and cloud security fundamentals.

• Excellent analytical and problem-solving abilities.

• Ability to work effectively under pressure.

• Capable of handling multiple incidents simultaneously.

• Strong communication and interpersonal skills to collaborate with various teams.

About You (Nice-to-have experience)

• Education

• Security Frameworks

• Incident Response

• Vulnerability Management

Bonus Points

• Certifications

• Technical Proficiency