Overview
We are seeking a highly skilled Google SecOps Platform Engineer to support project-based delivery engagements involving Google SecOps (Chronicle) implementation, onboarding, migration, and optimisation initiatives.
The role requires deep expertise in SIEM engineering, data onboarding, parser development, detection engineering, and security platform automation. The engineer will contribute to migrations to Google SecOps, onboard new data sources, build detection use cases, and support observability pipelines across hybrid cloud environments. The role operates in a CI/CD-driven model where configurations, parsers, detections, and platform content are managed as code.
Key Responsibilities
Mandate:
Google SecOps Platform Engineering
· Onboard new log sources end to end, covering ingestion, parser development, field extraction, UDM mapping, normalisation, validation, and operational handover.
· Develop and maintain custom parsers for non-standard data sources.
· Configure, troubleshoot, and optimise data pipelines to maintain reliable, high-quality telemetry ingestion.
· Support ingestion quality, platform entitlement, capacity, and cost considerations.
Data Engineering and Integration
· Develop and maintain ingestion scripts, services, and integration components, including custom exporters where required.
· Build extraction, transformation, enrichment, and validation logic for security telemetry.
· Analyse end-to-end data flows across GCP and Azure and explain how data enters and moves through the platform.
· Troubleshoot ingestion bottlenecks, mapping issues, and pipeline performance concerns.
CI/CD and Delivery Automation
· Manage platform configurations and detection content through code rather than manual GUI changes.
· Follow Git-based workflows covering repositories, branching, pull requests, peer review, version control, and automated pipelines.
· Ensure changes are traceable from engineering through testing and deployment automation.
· Contribute to repeatable build, release, and rollback practices for platform content.
Client Delivery and Documentation
· Provide technical and architectural input to client stakeholders on platform direction and engineering decisions.
· Participate in customer workshops, technical reviews, solution discussions, and delivery governance.
· Produce professional engineering documentation, onboarding guides, solution designs, test evidence, operating procedures, and runbooks.
· Work independently while collaborating effectively with customer and internal delivery teams.
Desired:
Detection Engineering
· Design, build, test, peer review, deploy, and tune detection rules using YARA-L.
· Map detection content to the MITRE ATT&CK framework and applicable security use cases.
· Improve detection fidelity, reduce false positives, and maintain detection content through controlled lifecycle processes.
· Demonstrate strong, transferable Splunk SIEM detection engineering capability where Google SecOps experience is supplemented by adjacent expertise.
SIEM Migration and Security Operations Enablement
· Lead and support migration from Splunk or other SIEM platforms to Google SecOps.
· Map and migrate existing correlation rules, alerts, dashboards, data sources, and detection use cases.
· Validate migrated telemetry and detection outcomes and support operational readiness of the target environment.
· Work closely with SOC, platform, cloud, and engineering teams during transition and handover.
Required Skills and Experience
Must-Have Capabilities
· Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.
· Practical experience with data ingestion, UDM mapping, normalisation, validation, and security telemetry quality management.
· Experience writing and tuning YARA-L detection rules.
· Strong understanding of MITRE ATT&CK and security detection engineering practices.
· Proven SIEM engineering capability with Google SecOps.
· Experience with custom log-source onboarding and non-standard ingestion patterns.
· Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.
· Hands-on experience with Git-based engineering and CI/CD pipelines.
· Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.
· Strong troubleshooting, documentation, stakeholder communication, and client-facing delivery skills.
Preferred Skills
· Hands-on experience with BindPlane as an observability and collection pipeline across GCP and Azure.
· Experience with APIs, cloud-native exporters, data transformation, and telemetry enrichment.
· Exposure to detection-as-code, configuration-as-code, or infrastructure-as-code operating models.
· Experience supporting SOC operations or large-scale security transformation programmes.
· Knowledge of Google Cloud security services and enterprise security architecture.
Qualifications
· 3+ years of cybersecurity engineering experience, including substantial SIEM engineering exposure.
· Proven experience delivering customer-facing security engineering projects.
Preferred Certifications
· Google Cloud Professional Cloud Security Engineer.
· Relevant Google SecOps / Chronicle accreditation or training.
コグニザントについて
コグニザント（NASDAQ: CTSH）は、AI Builderおよびテクノロジーサービスプロバイダーとして、お客様にフルスタックのAIソリューションを構築することで、AI投資と企業価値を結ぶ架け橋となっています。業界、ビジネスプロセス、エンジニアリングに関する当社の深い専門知識を活かし、組織固有のビジネス環境をテクノロジー・システムに組み込みます。これにより、人間の可能性を最大限に引き出し、確かな成果を実現するとともに、急速に変化する世界においてグローバル企業が常に一歩先を行くための支援を行っています。 詳細については、cognizant.ai をご覧ください。
雇用に関する追加情報
本募集に記載されている報酬情報は、掲載日時点で正確なものです。Cognizantは、適用される法令に従い、いつでも本情報を変更する権利を留保します。
応募者は、対面またはビデオ会議による面接への参加を求められる場合があります。また、各面接の際に、現在有効な州政府または政府発行の身分証明書の提示を求められる場合があります。
Cognizantは機会均等雇用主です。応募および選考において、人種、肌の色、性別、宗教、信条、性的指向、性自認、国籍、障がい、遺伝情報、妊娠、退役軍人の地位、その他連邦法・州法・地方自治体の法律により保護されるいかなる特性に基づく差別も行いません。
