Overview
We are seeking a highly skilled Google SecOps Platform Engineer to support project-based delivery engagements involving Google SecOps (Chronicle) implementation, onboarding, migration, and optimisation initiatives.
The role requires deep expertise in SIEM engineering, data onboarding, parser development, detection engineering, and security platform automation. The engineer will contribute to migrations to Google SecOps, onboard new data sources, build detection use cases, and support observability pipelines across hybrid cloud environments. The role operates in a CI/CD-driven model where configurations, parsers, detections, and platform content are managed as code.
Key Responsibilities
Mandate:
Google SecOps Platform Engineering
· Onboard new log sources end to end, covering ingestion, parser development, field extraction, UDM mapping, normalisation, validation, and operational handover.
· Develop and maintain custom parsers for non-standard data sources.
· Configure, troubleshoot, and optimise data pipelines to maintain reliable, high-quality telemetry ingestion.
· Support ingestion quality, platform entitlement, capacity, and cost considerations.
Data Engineering and Integration
· Develop and maintain ingestion scripts, services, and integration components, including custom exporters where required.
· Build extraction, transformation, enrichment, and validation logic for security telemetry.
· Analyse end-to-end data flows across GCP and Azure and explain how data enters and moves through the platform.
· Troubleshoot ingestion bottlenecks, mapping issues, and pipeline performance concerns.
CI/CD and Delivery Automation
· Manage platform configurations and detection content through code rather than manual GUI changes.
· Follow Git-based workflows covering repositories, branching, pull requests, peer review, version control, and automated pipelines.
· Ensure changes are traceable from engineering through testing and deployment automation.
· Contribute to repeatable build, release, and rollback practices for platform content.
Client Delivery and Documentation
· Provide technical and architectural input to client stakeholders on platform direction and engineering decisions.
· Participate in customer workshops, technical reviews, solution discussions, and delivery governance.
· Produce professional engineering documentation, onboarding guides, solution designs, test evidence, operating procedures, and runbooks.
· Work independently while collaborating effectively with customer and internal delivery teams.
Desired:
Detection Engineering
· Design, build, test, peer review, deploy, and tune detection rules using YARA-L.
· Map detection content to the MITRE ATT&CK framework and applicable security use cases.
· Improve detection fidelity, reduce false positives, and maintain detection content through controlled lifecycle processes.
· Demonstrate strong, transferable Splunk SIEM detection engineering capability where Google SecOps experience is supplemented by adjacent expertise.
SIEM Migration and Security Operations Enablement
· Lead and support migration from Splunk or other SIEM platforms to Google SecOps.
· Map and migrate existing correlation rules, alerts, dashboards, data sources, and detection use cases.
· Validate migrated telemetry and detection outcomes and support operational readiness of the target environment.
· Work closely with SOC, platform, cloud, and engineering teams during transition and handover.
Required Skills and Experience
Must-Have Capabilities
· Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.
· Practical experience with data ingestion, UDM mapping, normalisation, validation, and security telemetry quality management.
· Experience writing and tuning YARA-L detection rules.
· Strong understanding of MITRE ATT&CK and security detection engineering practices.
· Proven SIEM engineering capability with Google SecOps.
· Experience with custom log-source onboarding and non-standard ingestion patterns.
· Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.
· Hands-on experience with Git-based engineering and CI/CD pipelines.
· Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.
· Strong troubleshooting, documentation, stakeholder communication, and client-facing delivery skills.
Preferred Skills
· Hands-on experience with BindPlane as an observability and collection pipeline across GCP and Azure.
· Experience with APIs, cloud-native exporters, data transformation, and telemetry enrichment.
· Exposure to detection-as-code, configuration-as-code, or infrastructure-as-code operating models.
· Experience supporting SOC operations or large-scale security transformation programmes.
· Knowledge of Google Cloud security services and enterprise security architecture.
Qualifications
· 3+ years of cybersecurity engineering experience, including substantial SIEM engineering exposure.
· Proven experience delivering customer-facing security engineering projects.
Preferred Certifications
· Google Cloud Professional Cloud Security Engineer.
· Relevant Google SecOps / Chronicle accreditation or training.
关于高知特 (Cognizant)
高知特(Cognizant)（纳斯达克代码：CTSH）作为一家AI Builder和相关技术服务提供商，致力于通过打造全栈AI解决方案，帮助企业将人工智能投资转化为实际价值。公司凭借深厚的行业经验、流程优化和工程技术专长，将企业独特的业务场景融入科技系统，赋能组织释放人才潜能，推动切实成果，并帮助全球企业在瞬息万变的环境中保持领先。如需了解更多详情，敬请访问 cognizant.ai 或关注@cognizant。
补充雇佣信息
薪酬信息截至本职位发布之日为准。Cognizant 保留在适用法律允许的范围内随时修改该信息的权利。
申请人可能需要通过现场面试或视频会议的方式参加面试。此外，候选人在每次面试时可能需要出示其当前所在州或政府签发的有效身份证件。
Cognizant 是一家提供平等就业机会的雇主。在招聘过程中，您的申请和候选资格不会因种族、肤色、性别、宗教、信仰、性取向、性别认同、国籍、残疾、遗传信息、怀孕、退伍军人身份或任何其他受联邦、州或地方法律保护的特征而受到影响。
