Overview
We are seeking a highly skilled Google SecOps Platform Engineer to support project-based delivery engagements involving Google SecOps (Chronicle) implementation, onboarding, migration, and optimisation initiatives.
The role requires deep expertise in SIEM engineering, data onboarding, parser development, detection engineering, and security platform automation. The engineer will contribute to migrations to Google SecOps, onboard new data sources, build detection use cases, and support observability pipelines across hybrid cloud environments. The role operates in a CI/CD-driven model where configurations, parsers, detections, and platform content are managed as code.
Key Responsibilities
Mandate:
Google SecOps Platform Engineering
· Onboard new log sources end to end, covering ingestion, parser development, field extraction, UDM mapping, normalisation, validation, and operational handover.
· Develop and maintain custom parsers for non-standard data sources.
· Configure, troubleshoot, and optimise data pipelines to maintain reliable, high-quality telemetry ingestion.
· Support ingestion quality, platform entitlement, capacity, and cost considerations.
Data Engineering and Integration
· Develop and maintain ingestion scripts, services, and integration components, including custom exporters where required.
· Build extraction, transformation, enrichment, and validation logic for security telemetry.
· Analyse end-to-end data flows across GCP and Azure and explain how data enters and moves through the platform.
· Troubleshoot ingestion bottlenecks, mapping issues, and pipeline performance concerns.
CI/CD and Delivery Automation
· Manage platform configurations and detection content through code rather than manual GUI changes.
· Follow Git-based workflows covering repositories, branching, pull requests, peer review, version control, and automated pipelines.
· Ensure changes are traceable from engineering through testing and deployment automation.
· Contribute to repeatable build, release, and rollback practices for platform content.
Client Delivery and Documentation
· Provide technical and architectural input to client stakeholders on platform direction and engineering decisions.
· Participate in customer workshops, technical reviews, solution discussions, and delivery governance.
· Produce professional engineering documentation, onboarding guides, solution designs, test evidence, operating procedures, and runbooks.
· Work independently while collaborating effectively with customer and internal delivery teams.
Desired:
Detection Engineering
· Design, build, test, peer review, deploy, and tune detection rules using YARA-L.
· Map detection content to the MITRE ATT&CK framework and applicable security use cases.
· Improve detection fidelity, reduce false positives, and maintain detection content through controlled lifecycle processes.
· Demonstrate strong, transferable Splunk SIEM detection engineering capability where Google SecOps experience is supplemented by adjacent expertise.
SIEM Migration and Security Operations Enablement
· Lead and support migration from Splunk or other SIEM platforms to Google SecOps.
· Map and migrate existing correlation rules, alerts, dashboards, data sources, and detection use cases.
· Validate migrated telemetry and detection outcomes and support operational readiness of the target environment.
· Work closely with SOC, platform, cloud, and engineering teams during transition and handover.
Required Skills and Experience
Must-Have Capabilities
· Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.
· Practical experience with data ingestion, UDM mapping, normalisation, validation, and security telemetry quality management.
· Experience writing and tuning YARA-L detection rules.
· Strong understanding of MITRE ATT&CK and security detection engineering practices.
· Proven SIEM engineering capability with Google SecOps.
· Experience with custom log-source onboarding and non-standard ingestion patterns.
· Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.
· Hands-on experience with Git-based engineering and CI/CD pipelines.
· Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.
· Strong troubleshooting, documentation, stakeholder communication, and client-facing delivery skills.
Preferred Skills
· Hands-on experience with BindPlane as an observability and collection pipeline across GCP and Azure.
· Experience with APIs, cloud-native exporters, data transformation, and telemetry enrichment.
· Exposure to detection-as-code, configuration-as-code, or infrastructure-as-code operating models.
· Experience supporting SOC operations or large-scale security transformation programmes.
· Knowledge of Google Cloud security services and enterprise security architecture.
Qualifications
· 3+ years of cybersecurity engineering experience, including substantial SIEM engineering exposure.
· Proven experience delivering customer-facing security engineering projects.
Preferred Certifications
· Google Cloud Professional Cloud Security Engineer.
· Relevant Google SecOps / Chronicle accreditation or training.
À propos de Cognizant
Cognizant (NASDAQ : CTSH) est un AI Builder et une entreprise de services numériques (ESN) élaborant des solutions complètes d’IA maximisant les investissements pour des résultats concrets. Sa profonde expertise des métiers, des processus et des technologies lui permet d’intégrer dans les systèmes technologiques le contexte unique de chaque organisation de l’ingénierie à la production à l’échelle. Son objectif : améliorer l’efficacité des équipes, créer de la valeur et permettre aux grandes entreprises de rester performantes dans un monde qui évolue rapidement. Pour en savoir plus : cognizant.ai ou @cognizant.
Renseignments suppplémentaires sur l'emploi
Les informations relatives à la rémunération du poste à pourvoir dépendent de la date de publication de l’offre de poste. Cognizant se réserve le droit de modifier ces informations à tout moment, sous réserve des lois applicables.
Cognizant est un employeur soucieux de l'égalité des chances entre candidats. Votre candidature sera étudiée indépendamment de votre race, couleur, sexe, religion, croyances, orientation sexuelle, identité de genre, origine, handicap, informations génétiques, grossesse, statut d'ancien militaire ou de toute autre critère jugé discriminant par les lois européennes ou françaises.
Vous êtes porteur d'un handicap, vous pouvez-nous contacter par courriel [email protected] si vous souhaitez préciser les aménagements nécessaires pour le poste ou les entretiens à venir.
Les candidats peuvent être invités à participer à des entretiens en face à face ou par vidéoconférence. En outre, les candidats peuvent être amenés à présenter une carte d'identité valide lors de chaque entretien.
