SIEM/SOAR Engineer - Cloud Sec Spec 3

Softthink Solutions; Washington (District of Columbia); On-site; USD 180,000 - 240,000; Full time

Job summary

Softthink Solutions is seeking a seasoned SIEM/SOAR Engineer to design and optimize the Google SecOps SIEM/SOAR environment for enterprise operations in Washington, DC.

You will configure ingestion pipelines, validate log flows, and implement detections and automation to support secure monitoring. The role requires cloud telemetry experience and strong collaboration with incident response teams.

Qualifications

• 10+ years of experience in SIEM/SOAR platforms (Google SecOps preferred).
• Experience building detection rules, automation workflows, and parser validation.
• Experience with cloud telemetry ingestion (Azure, AWS, on‑prem).

Responsibilities

• Configure ingestion pipelines and validate end‑to‑end log flow.
• Implement Google curated detections and build custom detection rules.
• Develop SOAR playbooks for SBA’s top incident categories.
• Integrate threat intelligence sources (Mandiant, Virus Total).
• Tune detections to meet false‑positive thresholds.
• Support UEBA dashboard configuration and risk scoring.
• Assist with runbook creation, analyst training, and operational transition.

Skills

SIEM/SOAR expertise

Google SecOps

Threat intelligence integration

Cloud telemetry ingestion

Detection rule development

Automation workflows

Parser validation

UEBA configuration

Education

Bachelor’s degree in Cybersecurity/IT or related field

Tools

GCP Security Suite

Cloud telemetry tools (Azure/AWS)

Job description

SIEM/SOAR Engineer (Cloud Sec Spec 3)

Location: Washington, DC

Work Authorization: US Citizen

Role Summary

The SIEM/SOAR Engineer builds and configures the Google SecOps SIEM/SOAR environment, ensuring ingestion pipelines, detections, playbooks, and automation workflows are fully operational and optimized for SBA’s enterprise security operations.

Roles & Responsibilities

• Configure ingestion pipelines and validate end‑to‑end log flow.
• Implement Google curated detections and build custom detection rules.
• Develop SOAR playbooks for SBA’s top incident categories.
• Integrate threat intelligence sources (Mandiant, Virus Total).
• Tune detections to meet false‑positive thresholds.
• Support UEBA dashboard configuration and risk scoring.
• Assist with runbook creation, analyst training, and operational transition.

Professional Experience Required

• 10+ years of experience with SIEM/SOAR platforms (Google SecOps preferred).
• Experience building detection rules, automation workflows, and parser validation.
• Experience with cloud telemetry ingestion (Azure, AWS, on‑prem).
• Experience with threat intelligence integration.

Educational Qualification

• Bachelor’s degree in Cybersecurity, IT, or related field.

Certifications

• Google SecOps, GIAC, CISSP, or equivalent preferred.