Detection & SOAR Engineer — Remote AU

Google Inc.; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

Mandiant Consulting, Google Cloud in Australia seeks a Mid-level Detection and SOAR Engineer to support the CDC with SIEM/SOAR maintenance, content creation, and incident response playbooks. You will collaborate with cross-functional teams and drive detections, automation, and governance across security operations.

You will maintain operational readiness of SIEM and SOAR platforms, tune detections, and integrate APIs to enable efficient incident response for clients across the region.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or related field.
• 3 years of experience in detection engineering, SOAR automation, or related role.
• 3 years of experience with SOC/CSIRT or incident response teams.
• Experience with detection tuning and creation leveraging SIEM/EDR/NDR tools.
• Experience with scripting SIEM solutions in Python or Powershell.

Responsibilities

• Identify challenges in customer CDC and plan improvements.
• Advise on technologies relied upon by the client CDC, CSIRT, and SOC.
• Create/modify SIEM use cases and SOAR playbooks (Python).
• Engage with client stakeholders to drive security issue resolution.
• Provide expertise for SIEM, SOAR, and SOC technologies to aid incident response.

Skills

Detection engineering

SOAR automation

SOC/CSIRT collaboration

Python scripting

Education

Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or related field

Tools

SIEM tools

Powershell

Python scripting

Sigma open signature format

Job description

Mandiant Consulting, Google Cloud in Australia seeks a Mid-level Detection and SOAR Engineer to support the CDC with SIEM/SOAR maintenance, content creation, and incident response playbooks. You will collaborate with cross-functional teams and drive detections, automation, and governance across security operations.

You will maintain operational readiness of SIEM and SOAR platforms, tune detections, and integrate APIs to enable efficient incident response for clients across the region.