Security Infrastructure Engineer – Google SecOps

• Plan and set up the GCP project(s) including resource hierarchy, naming conventions, billing association and required APIs. • Configure Identity and Access Management (IAM) with predefined and custom roles, service accounts, least-privilege access, and separation of duties. • Integrate identity with corporate IdP using Workforce Identity Federation or Cloud Identity, including SSO and group-based access. • Configure data access controls to scope users to entitled data and features. • Apply organization-level security controls such as organization policies, VPC Service Controls, audit logging and Cloud Monitoring alerting. • Provision and maintain GCP resources as code using Terraform or equivalent. • Administer the Google SecOps tenant: users, roles, settings, retention, entity and context ingestion, reference lists and integrations. • Monitor ingestion health and platform performance, including feed status, forwarder and agent health, parser errors and volume anomalies. • Manage data retention, storage, ingestion volumes, licensing, cost expectations, and report on usage and trends. • Manage platform lifecycle: release changes, new features, deprecations, change control for rules, parsers and integrations. • Maintain platform documentation, runbooks, architecture diagrams and standard operating procedures. • Support audit and compliance requests with evidence of logging coverage, access reviews, and retention settings. • Onboard data sources such as Windows/Linux hosts, firewalls, proxies, EDR, identity providers, email security, databases, network devices and cloud platforms. • Validate expected events and required fields compliance with the Unified Data Model (UDM). • Build, test and maintain parser extensions and custom parsers where default parsers do not meet requirements. • Track parser status, field coverage and gaps; drive remediation with log source owners. • Ingest Google Cloud logs (Cloud Audit Logs, VPC Flow Logs, DNS, Security Command Center findings) and other cloud sources. • Configure and maintain parsers, parser extensions and custom parsers; validate normalization into UDM. • Investigate parsing failures, incorrect field mappings, schema issues, and vendor log format changes. • Test parser modifications before production deployment and document validation results. • Monitor ingestion and normalization health using Health Hub and platform monitoring tools. • Administer IAM, role-based and data access controls adhering to least-privilege principles. • Manage service account access and integration credentials with identity and security teams. • Maintain credential and certificate inventories, track expirations, coordinate rotation and renewal. • Conduct periodic access reviews and review administrative changes per internal security requirements. • Ensure platform configurations and integrations comply with approved security standards and change controls. • Support SOC and detection engineers with log availability, UDM field validation, and troubleshooting detection dependencies. • Assist with testing, deployment, tuning, version control, and retirement of YARA-L detection rules. • Investigate ingestion, parsing, permissions, and platform configuration detection issues. • Configure and maintain threat intelligence integrations such as Mandiant, VirusTotal, and approved third-party sources. • Coordinate detection requirements and feedback with SOC teams while respecting their ownership. • Administer SOAR integrations, connectors, environments, permissions, and case-management configurations. • Develop, maintain, troubleshoot approved playbooks and automation using supported tools and Python. • Integrate approved security and IT tools including EDR, firewalls, identity platforms, and ticketing systems. • Automate enrichment, evidence gathering, and response workflows in collaboration with SOC stakeholders. • Test automation changes, manage integration credentials, ensure authorized containment or disruptive actions. • Maintain documentation for playbooks, connectors, dependencies, and recovery procedures. • Use Google SecOps APIs and Python to automate administration, reporting, and repetitive tasks. • Develop scripts and use APIs or CLI tools to automate administration, validation, and reporting tasks. • Report on integration health, log-source coverage, parsing issues, ingestion trends, incidents, and improvements. • Review ingestion growth, deduplicate telemetry preserving detection, retention, and compliance. • Identify and implement approved reliability, maintainability, and operational efficiency improvements. • Work with SOC analysts and incident responders translating requirements into configurations and automation. • Coordinate with infrastructure, application, cloud, identity, and network teams to resolve dependencies and connectivity. • Maintain architecture diagrams, support procedures, onboarding records, troubleshooting guides. • Provide knowledge transfer on platform capabilities, UDM search, ingestion troubleshooting, operational procedures. • Communicate service issues, change impacts, risks, and remediation progress clearly to technical and non-technical stakeholders. • Google Cloud, SIEM, or security engineering certifications are preferred. • Security certifications such as Security+, CySA+, GCIH, or CISSP are advantageous. • Hands-on experience administering Google SecOps (Chronicle). • Experience onboarding and troubleshooting enterprise log sources and maintaining ingestion pipelines. • Experience with incident, problem, access, and change-management processes. • Practical knowledge of Google SecOps administration, ingestion, parsers, UDM, search, and detection-rule management. • Working knowledge of Google Cloud IAM, service accounts, Cloud Logging, networking, and Pub/Sub integrations. • Understanding of Windows, Linux, network, endpoint, identity, and cloud security telemetry. • Experience troubleshooting Syslog, REST APIs, JSON, regex, timestamps, connectivity, and authentication. • Proficiency in Python for automation and API integration; familiarity with Bash or PowerShell. • Working knowledge of YARA-L, Git-based version control, and controlled testing and deployment. • Ability to produce accurate technical documentation and operational reports. • Google SecOps SOAR administration, playbook development, and connector maintenance. • Experience with Splunk, Microsoft Sentinel, QRadar, or other enterprise SIEM platforms. • Experience in multi-cloud, enterprise SOC, or MSSP environments. • Familiarity with BigQuery SQL, Terraform, containers, and CI/CD workflows. • Understanding of MITRE ATT&CK and the NIST Cybersecurity Framework. • Strong troubleshooting, analytical thinking, and problem-solving skills. • Clear communication and effective collaboration across teams, customers, and vendors. • Ability to prioritize work, follow dependencies, and manage multiple activities. • Attention to detail, ownership, and documentation-driven approach. • Ability to work independently while sharing knowledge and supporting team development.