Must Have Technical/Functional Skills:
SIEM Technologies
Google SecOps (Chronicle) SIEM, Security Event Monitoring, Log Analysis and Correlation, Detection Engineering, Use Case Development
SOAR Technologies
Google SecOps SOAR, Security Orchestration and Automation, Playbook Development, API Integrations, Workflow Automation
Security Domains
Incident Response, Threat Intelligence, Threat Hunting, Endpoint Security, Cloud Security, Vulnerability Management
Roles & Responsibilities:
Technical:
Perform investigation and escalation for complex or high severity security threats or incidents
Security monitoring experience with one or more SIEM technologies Google SecOps SIEM (preferable), Splunk.
Conduct multi-step breach and investigative analysis to trace the dynamic activities associated with advanced threats
Work with SIEM Engineering and other security partners developing and refining correlation rules
Create and develop SOC processes and procedures working with Level 3, Level 2 and Level 1 Analysts
Drive Use Case Roadmap development and Use Case validation
Perform regular threat hunting utilizing security tools and intelligence information to identify and remediate potential security threats
Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs)
Maintain and drive the development of new reports of Cyber Threat Intelligence analysis and making threat intelligence actionable
Google SecOps Administration & Engineering:
Configure, administer, and maintain Google SecOps SIEM and SOAR platforms.
Onboard and validate log sources from security, cloud, network, endpoint, IAM, and application environments.
Develop and tune correlation rules and detection use cases.
Configure threat detection content aligned with MITRE ATT&CK techniques.
Configure parsers, ingestion pipelines, and data normalization.
Develop and optimize detection rules, correlation rules, dashboards, and alerts.
Support log source integrations and ensure data quality and visibility.
Perform health checks and platform tuning to improve detection efficiency.
Coordinate with security tool owners and infrastructure teams for log enablement and troubleshooting.
SOAR & Security Automation:
Design, develop, and maintain SOAR playbooks and automated response workflows.
Integrate Google SecOps with security tools and third-party platforms.
Automate repetitive SOC tasks, incident enrichment, and response activities.
Configure orchestration workflows for malware, phishing, IAM, cloud, and endpoint incidents.
Improve SOC efficiency through continuous automation initiatives.
Threat Detection & Threat Intelligence:
Monitor threat intelligence feeds and external security advisories.
Tune detection logic is based on emerging threats and attack techniques.
Configure and manage threat intelligence integrations and reputation feeds.
Perform threat hunting activities utilizing SIEM and endpoint telemetry.
Provide proactive threat advisories and recommendations to stakeholders.
Analyze suspicious activities and identify security incidents.
Classify incidents according to severity and business impact.
Support incident response, containment, eradication, and recovery activities.
Coordinate with infrastructure, network, cloud, IAM, and endpoint teams during investigations.
Reporting & Governance:
Prepare weekly and monthly SOC operational reports.
Generate incident metrics, SLA reports, and executive dashboards.
Maintain SOC runbooks, operational procedures, use-case documentation, and knowledge repositories.
Participate in audits, compliance reviews, and security assessments.
SIEM Technologies:
Google SecOps (Chronicle) SIEM
Security Event Monitoring
Log Analysis and Correlation
Detection Engineering
Use Case Development
SOAR Technologies:
Google SecOps SOAR
Security Orchestration and Automation
Playbook Development
API Integrations
Workflow Automation
Security Domains:
Incident Response
Threat Intelligence
Threat Hunting
Endpoint Security
Cloud Security
Vulnerability Management
Generic Managerial Skills:
Communication - Ability to communicate Up, Down, and Across All Levels of the Organization and Technical Backgrounds
Detail Oriented - Good Understanding of Risk Management Framework.
Analytical, Self-motivated - Critical thinker who can analyze and identify basic indicators of compromise on hosts and applications.
Interpersonal skills and Professional demeanor - Respond to customer inquiries in a timely manner, guiding and advising customers on security best practices in a friendly customer facing manner
Problem-Solver - Processes tactical mitigations based on results of analysis and determination of threat validity
