Google Chronicle SIEM Engineer , SOC Automation Specialist & Platform

Role & responsibilities

• Design, implement, and optimize Google Chronicle SIEM for scalable log ingestion, parsing, normalization, and enrichment.
• Create and updating correlation rules and use cases 
• Develop and fine-tune detection rules, parsers, and correlation logic to improve threat detection accuracy.
• Integrate diverse log sources including firewalls, endpoint security, cloud services, IAM, ,network devices and etc.,.
• Build and maintain custom parsers and dashboards to enhance visibility into security events.
• Collaborate with threat hunting and detection engineering teams to identify and implement new detection logic.
• Design and implement automation workflows (SOAR-based or API-based) to reduce analyst workload and response time.
• Automate alert triage, enrichment, and response actions using scripts, playbooks, or orchestration tools.
• Integrate Google Chronicle with automation platforms (e.g., Cortex XSOAR, Splunk SOAR, Swimlane, or custom Python-based frameworks).

Bindplane :

• Deploy, configure, and manage Bind Plane agents across servers and cloud workloads.
• Set up data ingestion from multiple sources (Windows, Linux, databases, firewalls, cloud services).
• Normalize data schemas and forward logs to SIEM or observability tools (Chronicle, Elastic, Splunk).
• Configure pipelines for log transformation, labeling, and enrichment.
• Implement monitoring and alerts for agent health, performance, and log ingestion failures.
• Optimize ingestion pipelines to reduce latency and improve reliability.

Cribl:

• • Design, configure, and manage Cribl Stream pipelines for log, metric, and trace ingestion.
• Build data routing rules to send telemetry to multiple destinations (SIEM, S3, Data Lake).
• Implement data filtering, sampling, and transformation to optimize SIEM licensing.
• Integrate enterprise log sources including servers, firewalls, cloud platforms, and APM tools
•  Manage Cribl workers, leaders, and edge deployments.
• Troubleshoot ingestion delays, failed pipelines, and data parsing issues.
• Work with security teams to onboard new data sources into SIEM through Cribl.
• Develop proactive automation to reduce false positives, enhance correlation efficiency, and minimize noise.
• Continuously refine detection rules using data analytics and threat intelligence to eliminate redundant alerts.
• Conduct root cause analysis of recurring false positives and implement preventive detection improvements.
• Collaborate with threat intel teams to update use cases with the latest IOCs, TTPs, and MITRE ATT&CK mappings.
• Conduct periodic reviews and audits of alert quality, accuracy, and SOC performance metrics.
• Develop and maintain detection engineering and automation frameworks with strong documentation.
• Partner with SOC operations, engineering, and threat hunting teams for continuous improvement initiatives.
• Participate in the design of proactive monitoring, AI/ML-based anomaly detection, and predictive automation models.
• Drive initiatives for SOC modernization, focusing on agility, scalability, and advanced analytics.

Required Skills and Experience

• 710 years of experience in Security Operations, SIEM Engineering, or SOC Automation.
• Strong hands-on experience with Google Chronicle SIEM (log pipelines, UDM, rule writing, dashboards).
• Proficiency in Python, API integrations, and automation frameworks (SOAR tools or custom automation scripts).
• Solid understanding of SOC processes, incident response workflows, and playbook design.
• Knowledge of MITRE ATT&CK, threat intelligence feeds, and behavior-based detection models.
• Experience in reducing false positives, tuning detections, and implementing advanced correlation logic.
• Familiarity with cloud security logging (GCP, AWS, Azure) and endpoint security integrations.