- responsibilities:
- design and implement scalable log ingestion pipelines and develop custom parsers for diverse data sources to ensure high-quality telemetry.
- develop, test, and tune sophisticated detection rules using yara-l to identify emerging threats.
- build and automate complex incident response playbooks within the soar component to reduce mean time to respond (mttr).
- perform proactive threat hunting and forensic investigations leveraging google threat intelligence.
- minimum qualifications:
- deep expertise in google secops, including the unified siem and soar platform (formerly chronicle).
- proficiency in writing yara-l rules and a thorough understanding of the unified data model (udm) for log normalization. Hands-on experience with security automation, orchestration, and integrating third-party tools via apis.
- preferred qualifications: google cloud professional security engineer certification.