Google SecOps Engineer

Aviato Consulting; India; Remote; INR 7,979,000 - 11,968,000; Full time

Benefits offered by this job

Remote-friendly

Async-friendly

Great place to work

Job summary

Aviato Consulting Pty Ltd is seeking a hands-on Google SecOps (Chronicle) engineer to deliver end-to-end SIEM and SOAR solutions for Australian customers. You will own data onboarding, detection engineering, automated responses, and ongoing operations in a customer-facing role.

You will run workshops, translate security requirements into working configurations, and communicate trade-offs clearly to stakeholders while building parsers and data pipelines for diverse log sources.

Qualifications

• Hands-on SIEM deployment and operation experience.
• Direct Google SecOps / Chronicle experience preferred; transferable experience with Splunk, Microsoft Sentinel or similar.
• Proficient in writing/tuning detection rules (YARA-L, SPL, KQL) and working with a normalised data model.
• Experience building SOAR playbooks and automation, including API integrations.
• Ability to onboard log sources, develop parsers, and manage ingestion pipelines.
• Strong communication to lead technical sessions and translate security requirements.

Responsibilities

• Platform Build & Deployment: Deploy and configure Google SecOps with log onboarding and data pipelines.
• Detection Engineering: Design and tune detection content aligned to MITRE ATT&CK and ACSC guidance.
• SOAR Automation: Build and maintain playbooks and automate responses via APIs and connectors.
• Operate & Optimise: Monitor health and performance, tune rules, support investigations.
• Customer Delivery: Lead onboarding sessions and workshops; communicate progress and trade-offs.
• Integration & Data Engineering: Connect diverse log sources, develop parsers, ensure data quality.

Skills

SIEM engineering

Detection engineering

SOAR automation

Log onboarding

Customer-facing

Python scripting

Tools

YARA-L

SPL

KQL

APIs

Job description

We are a Google Cloud services firm delivering security operations transformations for enterprise customers across Australia. We are looking for a hands-on Google SecOps (Chronicle) engineer who can build, deploy, and operate modern SIEM and SOAR capabilities, and do so directly in front of the customer. You will own technical delivery end to end: from data onboarding and detection engineering through to automated response and ongoing operations.

This is a customer-facing engineering role. You will spend significant time with Australian customers, running workshops, gathering requirements, and explaining your work clearly to both technical and non-technical stakeholders.

Key Responsibilities

• Platform Build & Deployment: Deploy and configure Google SecOps, including log source onboarding, data ingestion pipelines, parser development, and normalisation to the Unified Data Model (UDM).
• Detection Engineering: Design, build, and tune detection content using YARA-L. Develop threat-hunting queries, reduce false positives, and align detection coverage to frameworks relevant to Australian customers (for example, MITRE ATT&CK and the ACSC Essential Eight).
• SOAR Automation: Build and maintain SOAR playbooks and response automation in Google SecOps. Integrate with customer tooling (ticketing, identity, cloud, email, endpoint) via APIs and out-of-the-box connectors to streamline triage and response.
• Operate & Optimise: Monitor platform health, ingestion, and detection performance. Tune rules and pipelines over time, support incident investigation, and keep the deployment reliable and cost-effective.
• Customer Delivery: Serve as the technical point of contact for customer engagements. Run onboarding sessions and workshops, translate security requirements into working configuration, and communicate progress, constraints, and trade-offs clearly to customer stakeholders.
• Integration & Data Engineering: Connect diverse log sources and feeds, build and maintain parsers, and ensure data quality and coverage across the customer environment.

Mandatory Experience & Qualifications

• SIEM Engineering: Hands-on experience deploying and operating a modern SIEM. Direct Google SecOps / Chronicle experience is strongly preferred; equivalent experience with Splunk, Microsoft Sentinel, or similar will be considered where transferable.
• Detection Engineering: Practical experience writing and tuning detection rules (YARA-L, SPL, KQL, or equivalent) and working with a normalised data model such as UDM.
• SOAR & Automation: Experience building SOAR playbooks and response automation (Google SecOps SOAR / Siemplify, Splunk SOAR, or similar), including integrating third-party tools via APIs.
• Log Onboarding & Parsing: Proven ability to onboard log sources, develop parsers, and manage ingestion pipelines.
• Customer-Facing Skills: Strong communication skills and the ability to lead technical sessions with customers, gather requirements, and explain complex security concepts to non-technical stakeholders.
• Scripting: Working proficiency in Python (or similar) for automation, integration, and tooling.

Beneficial / Optional Experience

Experience with Google Cloud Platform (GCP) and cloud security operations. Familiarity with Australian security frameworks and guidance, including the ACSC Information Security Manual (ISM), and IRAP-assessed environments. Relevant certifications such as Google Cloud Security Engineer, or SANS GIAC credentials (GCIA, GCDA, GDAT). Experience with CI/CD and detection-as-code practices for managing content in version control. A background in SOC operations, incident response, or threat hunting.

What We Offer

• Culture: Founded by ex-Googlers, with a focus on strong engineering practice and Google Cloud and AI innovation.
• Equity: ESOP (Employee Stock Ownership Plan) offered after 6 months.
• Bonus: Annual bonus based on performance.
• Flexibility: Remote-friendly, async-friendly work model, with time working alongside Australian customers.
• Recognition: A certified Great Place to Work.