Google SecOps Platform Engineer

Job summary

The Google SecOps Platform Engineer delivers SIEM implementation, onboarding, migration, and optimisation projects, building reliable security telemetry pipelines across hybrid GCP and Azure environments. The role develops custom parsers and YARA-L detections, maps and validates data using UDM, automates platform content through Git-based CI/CD, and supports migrations from Splunk and other SIEM platforms.

Qualifications

• Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.
• Experience with security data ingestion, UDM mapping, normalisation, validation, and telemetry quality management.
• Experience writing and tuning YARA-L detection rules.
• Strong understanding of MITRE ATT&CK and security detection engineering practices.
• Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.
• Hands-on experience with Git-based engineering and CI/CD pipelines.
• Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.
• At least 3 years of cybersecurity engineering experience, including substantial SIEM engineering exposure.
• Experience delivering customer-facing security engineering projects.

Responsibilities

• Onboard log sources, including ingestion, parser development, field extraction, UDM mapping, normalisation, validation, and operational handover.
• Develop and maintain custom parsers for non-standard data sources.
• Configure, troubleshoot, and optimise telemetry ingestion pipelines.
• Develop ingestion scripts, services, exporters, and data transformation and enrichment logic.
• Manage platform configurations and detection content through Git-based workflows and CI/CD.
• Design, test, peer review, deploy, and tune YARA-L detection rules.
• Map detection content to MITRE ATT&CK and improve detection fidelity.
• Lead or support migrations from Splunk and other SIEM platforms to Google SecOps.
• Advise client stakeholders and participate in workshops, technical reviews, and delivery governance.
• Produce solution designs, onboarding guides, test evidence, operating procedures, and runbooks.

Skills

Certifications

Industry

Relocation