SIEM Engineer

Manage security log ingestion, parsing and normalisation using Google SecOps, UDM, Bindplane and security data sources.

Key Responsibilities

• Assess log coverage for SentinelOne, Vectra, CyberArk, and Netskope: required log types, collection method (Bindplane or API feed), ingestion state, volume, and parser status.
• Configure and remediate Bindplane collectors and SecOps API feeds so all required log types are ingesting, and estimate incremental ingestion volume before each source is enabled.
• Validate parsing and UDM normalization, measure parse errors and required field population, confirm normalized events are searchable in Google SecOps, and build parser extensions or custom parsers where defaults fall short.
• Implement silent source and abnormal volume monitoring for every in-scope source, routed to Jira.
• Produce per-source onboarding runbooks and a parser troubleshooting guide, deliver knowledge transfer to the team, and provide an exit memo summarizing final ingestion and parsing state per source.

Required Qualifications

• Expert, hands-on Google SecOps (Chronicle) experience: feeds and ingestion, parsers and parser extensions, UDM, and search/query validation.
• Senior role in a SOC, or senior engineering support of a SOC. Minimum three years in security operations and three years of SIEM engineering.
• Hands-on onboarding and parsing experience with at least three of: SentinelOne, Vectra, CyberArk, Netskope.
• Experience with Bindplane, the Chronicle Forwarder, or an equivalent telemetry pipeline.

Preferred Qualifications

• Google Cloud Professional Security Operations Engineer or equivalent Google SecOps certification.
• Git-based configuration management experience (parser and pipeline-as-code workflows, CI validation).
• MITRE ATT&CK mapping and coverage measurement.
• Financial services or credit union experience.