Security Infrastructure Engineer - Google SecOps

Overview

We are seeking a skilled Security Infrastructure Engineer specializing in Google SecOps to join our team in Doha, Qatar. This role focuses on developing and managing security operations tools and processes across multi-cloud and on-premises environments to enhance threat detection, response automation, and infrastructure security.

Key Responsibilities

• Design and oversee telemetry data pipelines from multiple cloud platforms (GCP, AWS, Azure) and on-premises systems using Bind Plane Forwarders, Cloud-to-Cloud connectors, and Webhooks.
• Create and troubleshoot custom log parsers to convert varied log sources into a Unified Data Model, ensuring accurate normalization.
• Develop dashboards to monitor data ingestion health, tracking rates, latency, and data losses to guarantee high-quality inputs to the SIEM.
• Build and maintain automated incident response playbooks on Google SOAR via Python scripting and visual workflow builders.
• Develop and manage API connectors integrating Google SOAR with third-party security tools including firewalls, EDRs, IAM, and ticketing platforms.
• Streamline workflows by automating routine tasks such as artifact enrichment, evidence collection, and initial containment steps.
• Tailor the SOAR platform to SOC operational needs by configuring custom fields, stages, and SLA tracking mechanisms.
• Monitor system health continuously, ensuring data integrity and acceptable latency levels.
• Manage role-based access (RBAC) to secure sensitive information while enabling appropriate access for analysts.
• Handle integration of threat intelligence feeds from sources like Mandiant and Virus Total to keep detection mechanisms updated.
• Collaborate closely with SOC analysts to refine detection rules and minimize alert noise.
• Gather requirements from incident responders to translate manual workflows into automated processes within Google SOAR.
• Conduct training sessions to improve the team's proficiency with UDM Search and the Google SecOps interface, accelerating investigation timelines.
• Coordinate with cloud architects to optimize Cloud Logging and Pub/Sub configurations for seamless telemetry integration.
• Work alongside IT infrastructure teams to deploy and maintain telemetry forwarding agents on physical and virtual machines.
• Troubleshoot connectivity and firewall issues with network engineers to ensure reliable telemetry data flow to Google SecOps.

Qualifications and Experience

• Bachelor's degree in computer science, information technology, cybersecurity, or a related discipline.
• Certifications in SIEM platforms such as Google SecOps, Splunk, or Azure Sentinel preferred.
• Additional security certifications like Security+, CySA+, CEH, CISSP, or GCIH are advantageous.
• 3 to 5 years of relevant experience in security engineering, SOC automation, DevOps, security operations, or infrastructure security roles.

Technical Skills

• Extensive experience designing and managing enterprise SIEM/SOAR platforms, especially with 1–2 years focused on Google SecOps (Chronicle).
• Proficiency in Python scripting for automation and building custom API integrations.
• Competence in managing security aspects of Google Cloud Platform including VPC service controls, IAM, and Cloud Logging.
• Familiarity with Python (advanced), SQL (BigQuery), YARA/YARA-L, and Bash scripting languages.
• Understanding of security frameworks such as MITRE ATT&CK and NIST Cybersecurity Framework.
• Knowledge of development tools including Git, Terraform, Docker, and Kubernetes.
• Strong ability in parsing data formats like JSON, Protobuf, and utilizing Regex for log normalization.

Soft Skills

• Analytical mindset with solid problem-solving capabilities.
• Excellent verbal and written communication skills to convey technical concepts to diverse audiences.
• Self-driven with aptitude for managing multiple tasks and meeting deadlines independently.
• Detail-oriented approach paired with thorough documentation practices.