Google SecOps Administration & Engineer :: Denver, CO Hybrid

Job Role: Google SecOps Administration & Engineer
Job Location: Denver, CO Hybrid
Job Type: Contract
Pay Range: $55 –$60 /hour

Role Descriptions:
Google SecOps Administration & Engineer

MSS – Security Operations Center (SOC)
Google SecOps

Must Have Technical/Functional Skills:
SIEM Technologies
• Google SecOps (Chronicle) SIEM, Security Event Monitoring, Log Analysis and Correlation, Detection Engineering, Use Case Development
SOAR Technologies
• Google SecOps SOAR, Security Orchestration and Automation, Playbook Development, API Integrations, Workflow Automation
Security Domains
• Incident Response, Threat Intelligence, Threat Hunting, Endpoint Security, Cloud Security, Vulnerability Management

Roles & Responsibilities:
Technical:
• Perform investigation and escalation for complex or high severity security threats or incidents
• Security monitoring experience with one or more SIEM technologies – Google SecOps SIEM (preferable), Splunk.
• Conduct multi-step breach and investigative analysis to trace the dynamic activities associated with advanced threats
• Work with SIEM Engineering and other security partners developing and refining correlation rules
• Create and develop SOC processes and procedures working with Level 3, Level 2 and Level 1 Analysts
• Drive Use Case Roadmap development and Use Case validation
• Perform regular threat hunting utilizing security tools and intelligence information to identify and remediate potential security threats
• Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs)
• Maintain and drive the development of new reports of Cyber Threat Intelligence analysis and making threat intelligence actionable

Google SecOps Administration & Engineering:
• Configure, administer, and maintain Google SecOps SIEM and SOAR platforms.
• Onboard and validate log sources from security, cloud, network, endpoint, IAM, and application environments.
• Develop and tune correlation rules and detection use cases.
• Configure threat detection content aligned with MITRE ATT&CK techniques.
• Configure parsers, ingestion pipelines, and data normalization.
• Develop and optimize detection rules, correlation rules, dashboards, and alerts.
• Support log source integrations and ensure data quality and visibility.
• Perform health checks and platform tuning to improve detection efficiency.
• Coordinate with security tool owners and infrastructure teams for log enablement and troubleshooting.

SOAR & Security Automation:
• Design, develop, and maintain SOAR playbooks and automated response workflows.
• Integrate Google SecOps with security tools and third-party platforms.
• Automate repetitive SOC tasks, incident enrichment, and response activities.
• Configure orchestration workflows for malware, phishing, IAM, cloud, and endpoint incidents.
• Improve SOC efficiency through continuous automation initiatives.

Threat Detection & Threat Intelligence:
• Monitor threat intelligence feeds and external security advisories.
• Tune detection logic is based on emerging threats and attack techniques.
• Configure and manage threat intelligence integrations and reputation feeds.
• Perform threat hunting activities utilizing SIEM and endpoint telemetry.
• Provide proactive threat advisories and recommendations to stakeholders.
• Analyze suspicious activities and identify security incidents.
• Classify incidents according to severity and business impact.
• Support incident response, containment, eradication, and recovery activities.
• Coordinate with infrastructure, network, cloud, IAM, and endpoint teams during investigations.

Reporting & Governance:
• Prepare weekly and monthly SOC operational reports.
• Generate incident metrics, SLA reports, and executive dashboards.
• Maintain SOC runbooks, operational procedures, use-case documentation, and knowledge repositories.
• Participate in audits, compliance reviews, and security assessments.

SIEM Technologies:
• Google SecOps (Chronicle) SIEM
• Security Event Monitoring
• Log Analysis and Correlation
• Detection Engineering
• Use Case Development

SOAR Technologies:
• Google SecOps SOAR
• Security Orchestration and Automation
• Playbook Development
• API Integrations
• Workflow Automation

Security Domains:
• Incident Response
• Threat Intelligence
• Threat Hunting
• Endpoint Security
• Cloud Security
• Vulnerability Management

Generic Managerial Skills:
• Communication – Ability to communicate Up, Down, and Across All Levels of the Organization and Technical Backgrounds
• Detail Oriented – Good Understanding of Risk Management Framework.
• Analytical, Self-motivated – Critical thinker who can analyze and identify basic indicators of compromise on hosts and applications.
• Interpersonal skills and Professional demeanor – Respond to customer inquiries in a timely manner, guiding and advising customers on security best practices in a friendly customer facing manner
• Problem-Solver – Processes tactical mitigations based on results of analysis and determination of threat validity

Comments for Suppliers: Required hands-on Google SecOps experience. This will be tested during the evaluations and interviews.
Competencies: 10+ years experience