Security Infrastructure Engineer – Google SecOps

Plan and set up the GCP project(s) including resource hierarchy, naming conventions, billing association and required APIs. Configure Identity and Access Management (IAM) with predefined and custom roles, service accounts, least-privilege access, and separation of duties. Integrate identity with corporate IdP using Workforce Identity Federation or Cloud Identity, including SSO and group-based access. Configure data access controls to scope users to entitled data and features. Apply organization-level security controls such as organization policies, VPC Service Controls, audit logging and Cloud Monitoring alerting. Provision and maintain GCP resources as code using Terraform or equivalent. Administer the Google SecOps tenant: users, roles, settings, retention, entity and context ingestion, reference lists and integrations. Monitor ingestion health and platform performance, including feed status, forwarder and agent health, parser errors and volume anomalies. Manage data retention, storage, ingestion volumes, licensing, cost expectations, and report on usage and trends. Manage platform lifecycle: release changes, new features, deprecations, change control for rules, parsers and integrations. Maintain platform documentation, runbooks, architecture diagrams and standard operating procedures. Support audit and compliance requests with evidence of logging coverage, access reviews, and retention settings. Onboard data sources such as Windows/Linux hosts, firewalls, proxies, EDR, identity providers, email security, databases, network devices and cloud platforms. Validate expected events and required fields compliance with the Unified Data Model (UDM). Build, test and maintain parser extensions and custom parsers where default parsers do not meet requirements. Track parser status, field coverage and gaps; drive remediation with log source owners. Ingest Google Cloud logs (Cloud Audit Logs, VPC Flow Logs, DNS, Security Command Center findings) and other cloud sources. Configure and maintain parsers, parser extensions and custom parsers; validate normalization into UDM. Investigate parsing failures, incorrect field mappings, schema issues, and vendor log format changes. Test parser modifications before production deployment and document validation results. Monitor ingestion and normalization health using Health Hub and platform monitoring tools. Administer IAM, role-based and data access controls adhering to least-privilege principles. Manage service account access and integration credentials with identity and security teams. Maintain credential and certificate inventories, track expirations, coordinate rotation and renewal. Conduct periodic access reviews and review administrative changes per internal security requirements. Ensure platform configurations and integrations comply with approved security standards and change controls. Support SOC and detection engineers with log availability, UDM field validation, and troubleshooting detection dependencies. Assist with testing, deployment, tuning, version control, and retirement of YARA-L detection rules. Investigate ingestion, parsing, permissions, and platform configuration detection issues. Configure and maintain threat intelligence integrations such as Mandiant, VirusTotal, and approved third-party sources. Coordinate detection requirements and feedback with SOC teams while respecting their ownership. Administer SOAR integrations, connectors, environments, permissions, and case-management configurations. Develop, maintain, troubleshoot approved playbooks and automation using supported tools and Python. Integrate approved security and IT tools including EDR, firewalls, identity platforms, and ticketing systems. Automate enrichment, evidence gathering, and response workflows in collaboration with SOC stakeholders. Test automation changes, manage integration credentials, ensure authorized containment or disruptive actions. Maintain documentation for playbooks, connectors, dependencies, and recovery procedures. Use Google SecOps APIs and Python to automate administration, reporting, and repetitive tasks. Develop scripts and use APIs or CLI tools to automate administration, validation, and reporting tasks. Report on integration health, log-source coverage, parsing issues, ingestion trends, incidents, and improvements. Review ingestion growth, deduplicate telemetry preserving detection, retention, and compliance. Identify and implement approved reliability, maintainability, and operational efficiency improvements. Work with SOC analysts and incident responders translating requirements into configurations and automation. Coordinate with infrastructure, application, cloud, identity, and network teams to resolve dependencies and connectivity. Maintain architecture diagrams, support procedures, onboarding records, troubleshooting guides. Provide knowledge transfer on platform capabilities, UDM search, ingestion troubleshooting, operational procedures. Communicate service issues, change impacts, risks, and remediation progress clearly to technical and non-technical stakeholders.

Desired Candidate Profile

Google Cloud, SIEM, or security engineering certifications are preferred. Security certifications such as Security+, CySA+, GCIH, or CISSP are advantageous. Hands-on experience administering Google SecOps (Chronicle). Experience onboarding and troubleshooting enterprise log sources and maintaining ingestion pipelines. Experience with incident, problem, access, and change-management processes. Practical knowledge of Google SecOps administration, ingestion, parsers, UDM, search, and detection-rule management. Working knowledge of Google Cloud IAM, service accounts, Cloud Logging, networking, and Pub/Sub integrations. Understanding of Windows, Linux, network, endpoint, identity, and cloud security telemetry. Experience troubleshooting Syslog, REST APIs, JSON, regex, timestamps, connectivity, and authentication. Proficiency in Python for automation and API integration; familiarity with Bash or PowerShell. Working knowledge of YARA-L, Git-based version control, and controlled testing and deployment. Ability to produce accurate technical documentation and operational reports. Google SecOps SOAR administration, playbook development, and connector maintenance. Experience with Splunk, Microsoft Sentinel, QRadar, or other enterprise SIEM platforms. Experience in multi-cloud, enterprise SOC, or MSSP environments. Familiarity with BigQuery SQL, Terraform, containers, and CI/CD workflows. Understanding of MITRE ATT&CK and the NIST Cybersecurity Framework. Strong troubleshooting, analytical thinking, and problem-solving skills. Clear communication and effective collaboration across teams, customers, and vendors. Ability to prioritize work, follow dependencies, and manage multiple activities. Attention to detail, ownership, and documentation-driven approach. Ability to work independently while sharing knowledge and supporting team development. Employment Type Full-time

Keywords