Lead Cybersecurity Engineer - SIEM/AI
About The Position
The Lead Cybersecurity Engineer will lead the ongoing maturity and optimization of the Google SecOps platform, improving detection coverage, data quality, operational effectiveness, and overall SIEM capabilities. The role designs, builds, tunes, and maintains detection rules, parsers, data pipelines, and log integrations to provide reliable enterprise visibility. Working with Threat Intelligence and Cyber Defense teams, the engineer develops high-confidence detection content that translates emerging threats into actionable alerts. The role also evaluates Cyber Defense workflows and implements AI-assisted processes, tools, custom agents, integrations, automations, and enrichment capabilities to improve analyst efficiency, reduce manual effort, accelerate investigations, and improve response times. It supports the evolution of AI-driven alert triage by improving the quality, consistency, and context of the data and detections that power automation. The engineer defines and tracks program metrics, documents engineering solutions and operational processes, and partners with Security Operations, Threat Intelligence, Incident Response, and Engineering teams to continually improve detection and response capabilities. This is a hybrid role, with in-office expectations determined by location and subject to change based on evolving business needs. Applicants must be currently authorized to work in the United States and must not require employer sponsorship now or in the future. The anticipated annual base salary range is $112,000–$168,000; actual compensation depends on factors including location, experience, skills, qualifications, and internal equity. Employees may also be eligible for incentive compensation, long-term incentives, and benefits, where applicable.
Requirements
- At least 6 years of hands-on experience engineering and optimizing enterprise SIEM platforms, including implementing and maturing Google SecOps or a comparable SIEM solution.
- Strong expertise in Google SecOps, including detection engineering, parser development, log onboarding, data normalization, and platform administration.
- Demonstrated ability to improve SIEM effectiveness through expanded detection coverage, tuning, and data quality improvements.
- Experience applying AI and automation in security operations, such as alert triage, investigations, threat hunting, case management, or other Cyber Defense workflows.
- Ability to evaluate existing processes and implement solutions that reduce manual effort.
- Proficiency in Python or similar scripting languages for developing integrations, automations, and workflow enhancements.
- Strong understanding of detection engineering, attacker tactics and techniques, security telemetry, and the end-to-end security data lifecycle.
- Strong analytical, problem-solving, written communication, and verbal communication skills.
- Currently authorized to work in the United States and not require employer sponsorship now or in the future.
Responsibilities
- Lead the maturity and optimization of the Google SecOps platform, improving detection coverage, data quality, operational effectiveness, and SIEM capabilities.
- Design, build, tune, and maintain detection rules, parsers, data pipelines, and log integrations.
- Partner with Threat Intelligence and Cyber Defense teams to turn emerging threats into high-confidence actionable detection alerts.
- Evaluate Cyber Defense workflows and identify opportunities to streamline operations with AI-driven processes and automation.
- Design and implement AI-assisted workflows, tools, and custom agents to improve analyst efficiency and support AI-driven alert triage.
- Build integrations, automations, and enrichment capabilities to reduce manual effort, accelerate investigations, and improve response times.
- Define and track metrics such as detection effectiveness, false-positive reduction, automation adoption, and analyst productivity.
- Document detections, engineering solutions, workflows, and operational processes.
- Collaborate with Security Operations, Threat Intelligence, Incident Response, and Engineering teams to improve organizational detection and response capabilities.
Benefits
- Competitive compensation package, including base salary and incentive opportunities where applicable.
- Comprehensive health and wellness benefits for employees and eligible dependents.
- Retirement savings programs, including company matching contributions where available.
- Potential eligibility for long-term incentives and a comprehensive benefits package, where applicable.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
