Senior Google SecOps (Chronicle) Engineer

NCS Philippines; Taguig; Hybrid; PHP 1,200,000 - 2,400,000; Full time

Job summary

NCS Philippines is seeking an experienced Security Platform Engineer to implement and maintain Google SecOps (Chronicle) in enterprise environments. You will integrate diverse log sources, develop detection rules, and automate data processing using Python and JSON-based APIs.

You will collaborate with SOC analysts and security engineers to enhance monitoring capabilities, ensure data protection, and support customers with security monitoring requirements in a fast-paced, on-site role in the

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Security, Engineering, or related discipline.
• Relevant cybersecurity, cloud security, or Google Cloud certifications are an advantage.
• Minimum of 5 years of relevant experience in Security Operations, SIEM/SOAR Engineering, or Security Platform Engineering.
• Hands-on experience with Google SecOps (Chronicle) is strongly preferred and should be a key requirement.
• Experience configuring and managing SIEM platforms, particularly Google SecOps.
• Experience onboarding and integrating multiple security and technology log sources.
• Hands-on experience with log parsing, normalisation, data ingestion, and data pipeline troubleshooting.
• Experience developing and fine-tuning security detection rules and monitoring use cases.
• Working experience with YARA-L is an advantage.
• Experience using Python for scripting, automation, parser development, and API integrations.
• Experience working with JSON for data structures, log formats, and API payloads.
• Experience integrating security platforms through APIs and other integration methods.
• Exposure to SOAR platforms, playbooks, and security automation.
• General knowledge of PCI DSS and information security principles.
• General understanding of data security, data protection, and secure handling of sensitive information.
• Experience in an enterprise SOC, MSSP, managed security services, or cybersecurity engineering environment.

Responsibilities

• Google SecOps Platform Engineering: Configure, administer, maintain, and optimise Chronicle.
• Log Source Integration: Onboard and integrate security log sources into Google SecOps; manage ingestion, parsing, normalisation.
• Detection Engineering: Develop, configure, test, and tune detection rules and use cases; work with YARA-L.
• Scripting and Automation: Use Python for automation, JSON structures, and API integrations.
• SOAR and Security Automation: Configure playbooks, improve automation and integration with external systems.
• Platform Maintenance: Monitor health, apply upgrades, troubleshoot and improve reliability.
• Security, Compliance, Data Protection: Apply PCI DSS knowledge and secure data handling.
• Customer Support: Translate requirements into engineering solutions; document configurations and procedures.

Skills

Google SecOps

SIEM/SOAR

Detection Engineering

Log Source Integration

Python Scripting

JSON Data Structures

API Integration

PCI DSS Awareness

Data Protection

Education

Bachelor's degree in Computer Science/IT/Cybersecurity/Engineering

Tools

YARA-L

Google SecOps (Chronicle)

Job description

GENERAL RESPONSIBILITIES

The role is responsible for the engineering, configuration, integration, optimisation, and maintenance of Google Security Operations (Google SecOps), formerly known as Chronicle, and related Security Operations Centre (SOC) technologies.

The position focuses on developing and enhancing security monitoring platforms through log source integration, data ingestion, parsing, normalisation, detection engineering, automation, and API integrations. The role will ensure the reliability, performance, and effectiveness of the security platform while supporting customer-specific security monitoring requirements.

This is an engineering-focused position, requiring hands-on experience with Google SecOps, scripting for automation, and a general understanding of information security, PCI DSS, and data protection principles.

DUTIES AND RESPONSIBILITIES

1. Google SecOps Platform Engineering

• Configure, administer, maintain, and optimise Google Security Operations (Chronicle).

• Manage platform configurations, data ingestion pipelines, parsers, and security integrations.

• Optimise platform performance, reliability, and detection capabilities.

• Troubleshoot platform-related issues and ensure the effective operation of Google SecOps.

• Support platform enhancements and continuous improvement initiatives.

2. Log Source Integration and Data Engineering

• Onboard and integrate security and technology log sources into Google SecOps.

• Configure and troubleshoot log ingestion, parsing, normalisation, and enrichment.

• Work with different log formats and data structures, particularly JSON.

• Develop and maintain parsers to ensure accurate log extraction and field mapping.

• Validate log quality, ingestion completeness, and data consistency.

• Integrate external systems and security tools through APIs and other supported integration methods.

3. Detection Engineering

• Develop, configure, test, and fine-tune detection rules and correlation use cases within Google SecOps.

• Work with YARA-L to create and maintain detection rules.

• Translate customer security monitoring requirements into actionable detection use cases.

• Improve detection accuracy and coverage by analysing ingested log sources and identifying opportunities for enhancement.

• Support the development and optimisation of security monitoring capabilities.

4. Scripting and Automation

• Use Python scripting for operational automation, log processing, parser development, and API integrations.

• Work with JSON for log structures, API payloads, data transformation, and configuration.

• Develop and maintain lightweight scripts to automate repetitive engineering and integration tasks.

• Support API-based integrations between Google SecOps and external security platforms.

• Troubleshoot scripting and integration issues.

Note: Python is required for scripting and automation purposes, not full-scale software or application development.

5. SOAR and Security Automation

• Configure and optimise SOAR playbooks, workflows, and integrations.

• Support security automation, automated enrichment, and response capabilities.

• Integrate Google SecOps with external security technologies and enterprise systems.

• Identify opportunities to improve operational efficiency through automation.

6. Platform Maintenance and Troubleshooting

• Perform platform configuration changes, upgrades, maintenance, and continuous optimisation.

• Monitor platform health, data ingestion, and integration performance.

• Conduct root-cause analysis and implement corrective actions for platform-related issues.

• Provide technical support for ingestion, parsing, detection, and integration issues.

• Maintain platform stability, reliability, and operational efficiency.

7. Security, Compliance, and Data Protection

• Apply general knowledge of PCI DSS requirements and their relevance to security monitoring and logging.

• Understand fundamental data security principles, including data confidentiality, integrity, availability, and protection of sensitive information.

• Support appropriate handling, processing, and monitoring of security logs and sensitive data.

• Understand the importance of access controls, data protection, and security monitoring in enterprise environments.

8. Customer and Stakeholder Support

• Work with customers, SOC teams, and technical stakeholders to understand security monitoring and detection requirements.

• Provide technical guidance on Google SecOps configuration, log onboarding, integrations, parsing, and detection engineering.

• Prepare and maintain technical documentation, configuration guides, and integration procedures.

• Support knowledge transfer and collaboration with SOC analysts and security engineering teams.

LEADERSHIP COMPETENCIES

N/A

FUNCTIONAL / TECHNICAL COMPETENCIES

• Google Security Operations (Chronicle)

• SIEM and SOAR Engineering

• Detection Engineering and YARA-L

• Log Source Integration and Management

• Log Parsing, Normalisation, and Data Ingestion

• Python Scripting and Automation

• JSON Data Structures and API Integration

• Security Platform Configuration and Administration

• Information Security and Data Protection

• PCI DSS Awareness

• Incident Management

• Release and Deployment Management

• Configuration Management

• Systems Integration and Troubleshooting

CORE COMPETENCIES

Teamwork & Collaboration, Accountability, Customer Focus, Communication, Innovation, Quality

JOB SPECIFICATIONS

Education

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Security, Engineering, or a related discipline.

• Relevant cybersecurity, cloud security, or Google Cloud certifications are an advantage.

Related Work Experience

• Minimum of 5 years of relevant experience in Security Operations, SIEM/SOAR Engineering, or Security Platform Engineering.

• Hands-on experience with Google Security Operations (Google SecOps / Chronicle) is strongly preferred and should be a key requirement.

• Experience configuring and managing SIEM platforms, particularly Google SecOps.

• Experience onboarding and integrating multiple security and technology log sources.

• Hands-on experience with log parsing, normalisation, data ingestion, and data pipeline troubleshooting.

• Experience developing and fine-tuning security detection rules and monitoring use cases.

• Working experience with YARA-L is an advantage.

• Experience using Python for scripting, automation, parser development, and API integrations.

• Experience working with JSON for data structures, log formats, and API payloads.

• Experience integrating security platforms through APIs and other integration methods.

• Exposure to SOAR platforms, playbooks, and security automation.

• General knowledge of PCI DSS and information security principles.

• General understanding of data security, data protection, and secure handling of sensitive information.

• Experience in an enterprise SOC, MSSP, managed security services, or cybersecurity engineering environment.

Knowledge

• Google Security Operations (Chronicle) architecture, features, configuration, and administration.

• SIEM concepts, security event collection, log ingestion, and data pipelines.

• Google SecOps detection engineering, YARA-L rules, and security monitoring use cases.

• Log parsing, normalisation, enrichment, and data quality management.

• Python scripting for automation, parsing, and API integrations.

• JSON structures, data manipulation, and API communication.

• REST APIs, Syslog, and other security platform integration methods.

• SOAR concepts, automation workflows, and playbook configuration.

• General PCI DSS requirements and security monitoring considerations.

• Fundamental data security and protection principles.

• Security platform troubleshooting, performance monitoring, and lifecycle management.

Skills

• Strong hands-on engineering and configuration skills in Google SecOps (Chronicle).

• Ability to onboard, integrate, parse, and troubleshoot different log sources.

• Ability to develop and fine-tune detection rules using YARA-L.

• Practical Python scripting skills for automation, parsing, and API integrations.

• Ability to work with JSON data structures and API payloads.

• Strong understanding of SIEM architecture, log management, and security monitoring.

• Ability to troubleshoot data ingestion, parsing, and integration issues.

• General understanding of PCI DSS and data security principles.

• Strong analytical, problem-solving, and technical troubleshooting skills.

• Ability to translate customer security requirements into practical engineering solutions.

• Strong technical documentation and communication skills.

• Ability to collaborate effectively with SOC analysts, security engineers, technical teams, and customers.

• Strong technical ownership, accountability, and attention to quality.