Google SecOps Platform Engineer

Google SecOps Platform Engineer

We are seeking a highly skilled Google SecOps Platform Engineer to support project-based delivery engagements involving Google SecOps (Chronicle) implementation, onboarding, migration, and optimisation initiatives.

The role requires deep expertise in SIEM engineering, data onboarding, parser development, detection engineering, and security platform automation. The engineer will contribute to migrations to Google SecOps, onboard new data sources, build detection use cases, and support observability pipelines across hybrid cloud environments. The role operates in a CI/CD-driven model where configurations, parsers, detections, and platform content are managed as code.

Key Responsibilities

Mandate:

• Google SecOps Platform Engineering
• Onboard new log sources end to end, covering ingestion, parser development, field extraction, UDM mapping, normalisation, validation, and operational handover.
• Develop and maintain custom parsers for non-standard data sources.
• Configure, troubleshoot, and optimise data pipelines to maintain reliable, high-quality telemetry ingestion.
• Support ingestion quality, platform entitlement, capacity, and cost considerations.
• Data Engineering and Integration
• Develop and maintain ingestion scripts, services, and integration components, including custom exporters where required.
• Build extraction, transformation, enrichment, and validation logic for security telemetry.
• Analyse end-to-end data flows across GCP and Azure and explain how data enters and moves through the platform.
• Troubleshoot ingestion bottlenecks, mapping issues, and pipeline performance concerns.
• CI/CD and Delivery Automation
• Manage platform configurations and detection content through code rather than manual GUI changes.
• Follow Git-based workflows covering repositories, branching, pull requests, peer review, version control, and automated pipelines.
• Ensure changes are traceable from engineering through testing and deployment automation.
• Contribute to repeatable build, release, and rollback practices for platform content.
• Client Delivery and Documentation
• Provide technical and architectural input to client stakeholders on platform direction and engineering decisions.
• Participate in customer workshops, technical reviews, solution discussions, and delivery governance.
• Produce professional engineering documentation, onboarding guides, solution designs, test evidence, operating procedures, and runbooks.
• Work independently while collaborating effectively with customer and internal delivery teams.

Desired:

• Detection Engineering

• Design, build, test, peer review, deploy, and tune detection rules using YARA-L.

• Map detection content to the MITRE ATT&CK framework and applicable security use cases.

• Improve detection fidelity, reduce false positives, and maintain detection content through controlled lifecycle processes.

• Demonstrate strong, transferable Splunk SIEM detection engineering capability where Google SecOps experience is supplemented by adjacent expertise.

• SIEM Migration and Security Operations Enablement

• Lead and support migration from Splunk or other SIEM platforms to Google SecOps.

• Map and migrate existing correlation rules, alerts, dashboards, data sources, and detection use cases.

• Validate migrated telemetry and detection outcomes and support operational readiness of the target environment.

• Work closely with SOC, platform, cloud, and engineering teams during transition and handover.

• Required Skills and Experience

• Must-Have Capabilities

• Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.

• Practical experience with data ingestion, UDM mapping, normalisation, validation, and security telemetry quality management.

• Experience writing and tuning YARA-L detection rules.

• Strong understanding of MITRE ATT&CK and security detection engineering practices.

• Proven SIEM engineering capability with Google SecOps.

• Experience with custom log-source onboarding and non-standard ingestion patterns.

• Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.

• Hands-on experience with Git-based engineering and CI/CD pipelines.

• Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.

• Strong troubleshooting, documentation, stakeholder communication, and client-facing delivery skills.

• Preferred Skills

• Hands-on experience with BindPlane as an observability and collection pipeline across GCP and Azure.

• Experience with APIs, cloud-native exporters, data transformation, and telemetry enrichment.

• Exposure to detection-as-code, configuration-as-code, or infrastructure-as-code operating models.

• Experience supporting SOC operations or large-scale security transformation programmes.

• Knowledge of Google Cloud security services and enterprise security architecture.

Qualifications

• 3+ years of cybersecurity engineering experience, including substantial SIEM engineering exposure.

• Proven experience delivering customer-facing security engineering projects.

• Preferred Certifications

• Google Cloud Professional Cloud Security Engineer.

• Relevant Google SecOps / Chronicle accreditation or training.

• Additional employment information

• Compensation information is accurate as of the date of this posting. Cognizant reserves the right to modify this information at any time, subject to applicable law.

• Applicants may be required to attend interviews in person or by video conference. In addition, candidates may be required to present their current state or government issued ID during each interview.

• Cognizant is an equal opportunity employer. Your application and candidacy will not be considered based on race, color, sex, religion, creed, sexual orientation, gender identity, national origin, disability, genetic information, pregnancy, veteran status or any other characteristic protected by federal, state or local laws.

• Applicants for US based positions must be currently authorized to work for any employer in the United States. The company is unable to provide employment-based immigration sponsorship for US based positions.

• If you have a disability that requires reasonable accommodation to search for a job opening or submit an application, please email [email protected] for roles based in the Americas or [email protected] for roles based in India.

About Cognizant:

• Cognizant (Nasdaq: CTSH) is an AI Builder and technology services provider, bridging the gap between AI investment and enterprise value by building full-stack AI solutions for our clients. Our deep industry, process and engineering expertise enables us to build an organization’s unique context into technology systems that amplify human potential, drive tangible outcomes and keep global enterprises ahead in a fast-changing world. See how at cognizant.ai or @cognizant.