Google Secops Security Engineer

Security Engineer Role: Security Engineer

Location: Hybrid in Boston, MA

Job Type: Contract

Job Description:

Key Responsibilities

Implement, configure, and maintain Google SecOps (Chronicle SIEM + SOAR)

Own SecOps platform configuration end-to-end: data sources, parsers, correlation rules, enrichments, user/role configuration, and integration with ticketing/ITSM and messaging tools.

Design and implement “detection as code”: manage SIEM detections, correlation rules, and content in version control (e.g., Git), using code-driven workflows, reviews, and CI/CD where applicable.

Develop, tune, and maintain reusable detection logic, including rule templates, mappings to MITRE ATT&CK, and test cases for validating new and updated detections.

Create, maintain, and optimize automation playbooks in SOAR for common and complex use cases (phishing triage, suspicious login, malware, data exfiltration, privilege escalation, cloud misconfigurations).

Continuously improve automation coverage and quality by identifying manual tasks, converting them into playbooks, and measuring playbook performance (MTTR, auto-resolution rate, false positives).

Onboard and normalize security telemetry from GCP, SaaS platforms, endpoints, network devices, and identity providers into Google SecOps, including parser/taxonomy tuning.

Own L2 triage of security alerts: validate, correlate, and prioritize events escalated by L1, and perform deep-dive investigations using Chronicle search, pivots, and threat intelligence.

Lead or participate in incident response: containment, eradication, recovery, documentation, and post-incident review; feed lessons learned back into detections and automation playbooks.

Contribute to proactive threat hunting based on hypotheses, IOCs, TTPs, and threat intel feeds, and codify successful hunts into reusable detections and automated workflows.

Act as a stand in On call support one week per month for any major escalations

Monitor platform health and data quality for Google SecOps (log gaps, parsing errors, latency, ingestion failures) and drive resolution with engineering/ops teams.

Document runbooks, SOPs, detection and playbook catalogs, and knowledge articles to enable L1 teams and ensure consistent service delivery.

Required Skills and Experience

3–5 years of experience in Security Operations (SOC), Incident Response, or Security Engineering, including hands-on work in cloud environments (preferably GCP).

Strong experience with SIEM/SOAR platforms; direct experience with Google SecOps / Chronicle SIEM + SOAR is highly preferred.

Proven experience implementing detection-as-code practices: managing rules/content, using branching, code review, and testing approaches for detections and playbooks.

Experience designing and maintaining automation playbooks in SOAR tools, including integrations (REST APIs, webhooks, custom connectors) and error-handling strategies.

Good understanding of security concepts and services: IAM, VPC, firewall rules, Cloud DNS, Cloud Storage, Load Balancing, Security Command Center, Cloud Logs, and Monitoring.

Solid knowledge of network and security fundamentals: TCP/IP, DNS, VPNs, proxies, IDS/IPS, WAF, EDR, authentication and authorization, encryption, and common attack techniques.

Demonstrated experience in incident handling, threat analysis, and root cause analysis across endpoints, identities, and cloud workloads.

Scripting or automation skills (e.g., Python, Bash, YAML, or similar) to build integrations, detections, and SOAR workflows, and to support CI/CD for SecOps content.

Familiarity with security frameworks and standards (MITRE ATT&CK, NIST, CIS, SOC 2, PCI-DSS, ISO 27001) and how they map to detections and controls.

Strong analytical and troubleshooting skills, with the ability to work independently in an L2 capacity and mentor L1 analysts.

Excellent written and verbal communication skills for working with US-based stakeholders and documenting technical content.

Good To Have/Preferred:

Google Cloud Professional Security Operations Engineer or Professional Cloud Security Engineer certification.

Prior experience working with US enterprises, MSSP environments, or 24x7 global SOCs.

If you are interested, please send me your updated resume ASAP with below details:

1. Full Name:

2. Current Location/Zip:

3. Visa/Work Permit Status:

4. Notice Period/Availability to Start:

5. Willingness to relocate to job location:

6. Preferred Interview timings (Specify Time zone):

7. LinkedIn URL: