Google SecOps_CYBERSEC_India

Title: Google SecOps_CYBERSEC_India

Relevant Experience: 5 Yrs

Location: Pan India

Vendor Rate: 8,330.00 - 9,330.00

Description

Key Responsibilities:

• Experience Migrating from incumbent SIEM/SOAR platform to Google SecOps preferred.

• Familiarity in terms of mapping Radar rules, building blocks (BBs), and reference sets (RS) to GSO equivalent.

• Migrating Network Flow Data (NetFlow, sFlow, J-Flow) to GSO equivalent.

• Conduct requirements gathering and security use-case assessments.

• Configure and validate log source onboarding into Google SecOps.

• Perform UDM normalization and data validation activities.

• Develop and customize parsers for new log source integrations.

• Migrate SIEM content from Splunk, QRadar, ArcSight, Sentinel, etc., to Google SecOps.

• Map existing use cases/rules to Google SecOps detections.

• Perform gap analysis and monitoring coverage assessments.

• Design, develop, and optimize detection rules and correlation logic.

• Create security use cases aligned to MITRE Telecommunication&CK and Cyber Kill Chain frameworks.

• Review and tune SIEM content to improve detection effectiveness and reduce false positives.

• Integrate security tools, cloud platforms, and third-party solutions with Google SecOps.

• Build dashboards, reports, KPIs, and operational metrics.

• Conduct threat hunting using Google SecOps and threat intelligence.

• Perform threat modeling and identify monitoring opportunities.

• Recommend improvements to SOC processes, detection coverage, and platform utilization.

• Develop SOPs, runbooks, playbooks, and engineering documentation.

• Support KT, reverse KT, shadowing, and go-live activities.

• Drive security monitoring modernization and automation initiatives.

Mandatory Skills:

• 5+ years of Information Security and SIEM Engineering experience.

• Strong hands-on experience with Google SecOps (Chronicle SIEM).

• Experience with Splunk, IBM QRadar, ArcSight, Microsoft Sentinel, or similar SIEM platforms.

• Expertise in SIEM onboarding, content engineering, and platform transformation.

• Experience with parser development and log source integrations.

• Strong knowledge of Detection Engineering and Threat Hunting.

• Knowledge of MITRE Telecommunication&CK, Cyber Kill Chain, and Threat Intelligence.

• Scripting knowledge (Python/PowerShell) preferred.

• Experience working with cloud security environments (AWS/Azure/GCP) preferred.