Security Operations Tech Lead

Verily•Dallas, TX

About The Position

The Security Operations Tech Lead advances cloud detection and response capabilities across Google Cloud Platform (GCP) and AWS. This hands-on individual contributor role combines security expertise with software engineering and site reliability engineering practices to build reliable, scalable, and cost-efficient systems that protect cloud infrastructure, applications, and sensitive health data. The role shapes cloud detection strategy, develops high-throughput security telemetry pipelines, and automates investigation and response workflows. The Tech Lead partners with Cloud Infrastructure, Platform, and Product Engineering teams to translate knowledge of systems and emerging threats into robust security controls. It offers broad technical ownership, cross-functional initiative leadership, and opportunities to mentor engineers across the organization.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or equivalent practical experience.
At least 8 years of professional experience in security engineering, site reliability engineering, platform engineering, or security operations with production cloud systems.
Deep technical expertise securing Google Cloud Platform (GCP) or Amazon Web Services (AWS), with a strong focus on IAM, VPC networking, cloud logging, and containerized workloads.
Hands-on experience developing security detection logic, investigating threats, and engineering security telemetry within an enterprise SIEM or modern analytics platform.
Demonstrated experience with Infrastructure as Code (e.g., Terraform), CI/CD pipelines, distributed systems troubleshooting, and production observability.

Nice To Haves

Advanced expertise with native GCP security services (Cloud Audit Logs, VPC Flow Logs, Security Command Center Enterprise, Cloud Armor) alongside multi-cloud operations across AWS and Azure.
Hands-on experience engineering high-volume log ingestion pipelines, custom parsers, and threat detections using CrowdStrike Falcon Next-Gen SIEM, Humio/LogScale, or modern big data platforms such as BigQuery or Snowflake.
Experience designing and implementing security controls within healthcare, life sciences, or heavily regulated environments subject to HIPAA, NIST frameworks, or CIS benchmarks.
Proven experience securing Kubernetes clusters (GKE/EKS), container runtimes, web applications, and AI/ML workloads incorporating Large Language Models (LLMs).

Responsibilities

Design, test, deploy, and continuously improve detections for complex cloud threats, including identity and access abuse, suspicious application activity, data exposure, and container and Kubernetes attacks.
Drive proactive threat hunting and cloud asset discovery initiatives to identify visibility gaps and prioritize detection coverage across multi-cloud environments.
Own end-to-end telemetry pipelines that collect, parse, normalize, and enrich cloud audit, network, and application logs, balancing investigative value, retention, data protection, and cost efficiency.
Apply Site Reliability Engineering (SRE) principles to telemetry and detection services, establishing SLOs and SLIs for data freshness, availability, and completeness while building actionable alerting, recovery procedures, and capacity plans.
Develop software, Infrastructure as Code (IaC), and automated workflows to reduce manual toil and technical debt, enforcing code review, automated testing, version control, and CI/CD deployment practices for detection content.
Lead cross-functional initiatives and mentor engineers across the organization.