Cloud SecOps SIEM/SOAR Engineer

Softthink Solutions; Washington (District of Columbia); On-site; USD 180,000 - 240,000; Full time

Job summary

Softthink Solutions is seeking a seasoned SIEM/SOAR Engineer to design and optimize the Google SecOps SIEM/SOAR environment for enterprise operations in Washington, DC.

You will configure ingestion pipelines, validate log flows, and implement detections and automation to support secure monitoring. The role requires cloud telemetry experience and strong collaboration with incident response teams.

Qualifications

• 10+ years of experience in SIEM/SOAR platforms (Google SecOps preferred).
• Experience building detection rules, automation workflows, and parser validation.
• Experience with cloud telemetry ingestion (Azure, AWS, on‑prem).

Responsibilities

• Configure ingestion pipelines and validate end‑to‑end log flow.
• Implement Google curated detections and build custom detection rules.
• Develop SOAR playbooks for SBA’s top incident categories.
• Integrate threat intelligence sources (Mandiant, Virus Total).
• Tune detections to meet false‑positive thresholds.
• Support UEBA dashboard configuration and risk scoring.
• Assist with runbook creation, analyst training, and operational transition.

Skills

SIEM/SOAR expertise

Google SecOps

Threat intelligence integration

Cloud telemetry ingestion

Detection rule development

Automation workflows

Parser validation

UEBA configuration

Education

Bachelor’s degree in Cybersecurity/IT or related field

Tools

GCP Security Suite

Cloud telemetry tools (Azure/AWS)

Job description

Softthink Solutions is seeking a seasoned SIEM/SOAR Engineer to design and optimize the Google SecOps SIEM/SOAR environment for enterprise operations in Washington, DC.

You will configure ingestion pipelines, validate log flows, and implement detections and automation to support secure monitoring. The role requires cloud telemetry experience and strong collaboration with incident response teams.