Security Infrastructure Engineer – Google SecOps

About the role

We are looking for a Security Infrastructure Engineer specialized in Google SecOps to design, build and maintain the data ingestion and automation pipelines that feed our security operations centre. The role bridges cloud and on‑prem environments, ensuring high‑quality telemetry reaches our SIEM and that incident response playbooks run smoothly.

Key responsibilities

• Architect and operate multi‑cloud telemetry ingestion (GCP, AWS, Azure) using Bind Plane Forwarders, Cloud‑to‑Cloud connectors and Webhooks.
• Develop and troubleshoot custom parsers (CBN) to normalize logs into the Unified Data Model.
• Build dashboards to monitor ingestion health, latency and data loss.
• Design, code and maintain Google SOAR playbooks in Python and visual builders.
• Create and manage API integrations between Google SOAR and firewalls, EDR, IAM and ticketing tools.
• Configure case management, RBAC and SLA tracking within the SOAR platform.
• Integrate threat‑intel feeds (Mandiant, VirusTotal) and keep detection rules up‑to‑date.
• Collaborate with SOC analysts, network engineers and cloud architects to resolve connectivity issues and optimise workflows.

Required profile

• Bachelor’s degree in Computer Science, IT, Cybersecurity or equivalent.
• 3–5 years of hands‑on experience with Google SecOps or comparable SIEM platforms.
• SIEM certification (Google SecOps, Splunk, Azure Sentinel) – preferred.
• Security certifications such as Security+, CySA+, CEH, CISSP or GCIH are a plus.

Required skills

• Python programming.
• Google Cloud Platform (GCP), AWS and Azure.
• Pub/Sub, Cloud Logging and API integration.
• Bind Plane Forwarders, CBN parsers and Webhooks.
• Google SOAR, playbook development and automation.
• YARA‑L rule tuning.
• Role‑Based Access Control (RBAC) and SIEM administration.
• Threat‑intel feed integration (Mandiant, VirusTotal).