SIEM SOAR Engineer

SecOps SIEM SOAR Engineer, Google Cloud Professional Services

• Extension of pre-built UDMs in Google SecOps and creation of custom parsers where required for log sources.
• Integration of Google SecOps SIEM with other security capabilities and tools such as SOAR, EDR, NDR, threat intelligence platform, and ticketing systems.
• Write custom actions, scripts and/or integrations to extend SIEM platform functionality.
• Monitor performance and perform timely actions to scale SIEM deployment, especially in a very high-volume security environment.
• Creation of SIEM assets such as: detection rules using YARA-L, dashboards, parsers etc.
• Migration of existing assets from existing customers SIEM/SOAR to SecOps and assisting in implementing the SIEM/SOAR phase-out, phase-in approach.
• Testing and deployment of newly created and migrated assets such as rules, playbooks, alerts, dashbords etc
• Design and implement solutions to handle alert fatigue encountered in SIEM correlation.
• Creation of custom SIEM dashboards to meet customer requirements.
• Guide on building or maturing cloud security programs and the implementation of tools and approaches used for improving cloud security.
• Debug and solve customer issues in ingestion, parsing, normalization of data etc
• Develop SOAR playbooks to provide case handling and Incident response as per triage needs
• Lead the design and implementation of Google SecOps SOAR playbooks for security use cases, such as phishing incident response, vulnerability triage, or threat hunting on Google SecOps based on specific threat models.
• Integration of Google SecOps SOAR with other security capabilities and tools such as SIEM, EDR, NDR threat intelligence platform, and ticketing systems.
• Design testing and conduct validation of SOAR playbooks before deployment to live environment.
• Write custom actions, scripts and/or integrations to extend SOAR platform functionality.
• Monitor performance and perform timely actions to scale SOAR deployment, especially in a high-volume security environment.
• Migration of existing assets from existing customers SIEM/SOAR to SecOps and assisting in implementing the SIEM/SOAR phase-out, phase-in approach.
• Develop SOAR playbooks to provide case handling and Incident response as per triage needs
• Creation of SOAR assets such as reports etc.
• Guide on building or maturing cloud security programs