Google SecOps Platform Engineer

Overview

We are seeking a highly skilled Google SecOps Platform Engineer to support project-based delivery engagements involving Google SecOps (Chronicle) implementation, onboarding, migration, and optimisation initiatives.

The role requires deep expertise in SIEM engineering, data onboarding, parser development, detection engineering, and security platform automation. The engineer will contribute to migrations to Google SecOps, onboard new data sources, build detection use cases, and support observability pipelines across hybrid cloud environments. The role operates in a CI/CD-driven model where configurations, parsers, detections, and platform content are managed as code.

Key Responsibilities

Mandate:

Google SecOps Platform Engineering

· Onboard new log sources end to end, covering ingestion, parser development, field extraction, UDM mapping, normalisation, validation, and operational handover.

· Develop and maintain custom parsers for non-standard data sources.

· Configure, troubleshoot, and optimise data pipelines to maintain reliable, high-quality telemetry ingestion.

· Support ingestion quality, platform entitlement, capacity, and cost considerations.

Data Engineering and Integration

· Develop and maintain ingestion scripts, services, and integration components, including custom exporters where required.

· Build extraction, transformation, enrichment, and validation logic for security telemetry.

· Analyse end-to-end data flows across GCP and Azure and explain how data enters and moves through the platform.

· Troubleshoot ingestion bottlenecks, mapping issues, and pipeline performance concerns.

CI/CD and Delivery Automation

· Manage platform configurations and detection content through code rather than manual GUI changes.

· Follow Git-based workflows covering repositories, branching, pull requests, peer review, version control, and automated pipelines.

· Ensure changes are traceable from engineering through testing and deployment automation.

· Contribute to repeatable build, release, and rollback practices for platform content.

Client Delivery and Documentation

· Provide technical and architectural input to client stakeholders on platform direction and engineering decisions.

· Participate in customer workshops, technical reviews, solution discussions, and delivery governance.

· Produce professional engineering documentation, onboarding guides, solution designs, test evidence, operating procedures, and runbooks.

· Work independently while collaborating effectively with customer and internal delivery teams.

Desired:

Detection Engineering

· Design, build, test, peer review, deploy, and tune detection rules using YARA-L.

· Map detection content to the MITRE ATT&CK framework and applicable security use cases.

· Improve detection fidelity, reduce false positives, and maintain detection content through controlled lifecycle processes.

· Demonstrate strong, transferable Splunk SIEM detection engineering capability where Google SecOps experience is supplemented by adjacent expertise.

SIEM Migration and Security Operations Enablement

· Lead and support migration from Splunk or other SIEM platforms to Google SecOps.

· Map and migrate existing correlation rules, alerts, dashboards, data sources, and detection use cases.

· Validate migrated telemetry and detection outcomes and support operational readiness of the target environment.

· Work closely with SOC, platform, cloud, and engineering teams during transition and handover.

Required Skills and Experience

Must-Have Capabilities

· Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.

· Practical experience with data ingestion, UDM mapping, normalisation, validation, and security telemetry quality management.

· Experience writing and tuning YARA-L detection rules.

· Strong understanding of MITRE ATT&CK and security detection engineering practices.

· Proven SIEM engineering capability with Google SecOps.

· Experience with custom log-source onboarding and non-standard ingestion patterns.

· Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.

· Hands-on experience with Git-based engineering and CI/CD pipelines.

· Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.

· Strong troubleshooting, documentation, stakeholder communication, and client-facing delivery skills.

Preferred Skills

· Hands-on experience with BindPlane as an observability and collection pipeline across GCP and Azure.

· Experience with APIs, cloud-native exporters, data transformation, and telemetry enrichment.

· Exposure to detection-as-code, configuration-as-code, or infrastructure-as-code operating models.

· Experience supporting SOC operations or large-scale security transformation programmes.

· Knowledge of Google Cloud security services and enterprise security architecture.

Qualifications

· 3+ years of cybersecurity engineering experience, including substantial SIEM engineering exposure.

· Proven experience delivering customer-facing security engineering projects.

Preferred Certifications

· Google Cloud Professional Cloud Security Engineer.

· Relevant Google SecOps / Chronicle accreditation or training.