SIEM/SOAR Engineer - Cloud Sec Spec 3
Softthink Solutions•Washington, DC
•Onsite
About The Position
The SIEM/SOAR Engineer builds and configures the Google SecOps SIEM/SOAR environment, ensuring ingestion pipelines, detections, playbooks, and automation workflows are fully operational and optimized for SBA’s enterprise security operations.
Requirements
- 10+ years of experience with SIEM/SOAR platforms (Google SecOps preferred).
- Experience building detection rules, automation workflows, and parser validation.
- Experience with cloud telemetry ingestion (Azure, AWS, on-prem).
- Experience with threat intelligence integration.
- Bachelor’s degree in Cybersecurity, IT, or related field.
Nice To Haves
- Google SecOps, GIAC, CISSP, or equivalent preferred.
Responsibilities
- Configure ingestion pipelines and validate end‑to‑end log flow.
- Implement Google curated detections and build custom detection rules.
- Develop SOAR playbooks for SBA’s top incident categories.
- Integrate threat intelligence sources (Mandiant, Virus Total).
- Tune detections to meet false‑positive thresholds.
- Support UEBA dashboard configuration and risk scoring.
- Assist with runbook creation, analyst training, and operational transition.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
Upload and Match Resume
What This Job Offers
Job Type
Full-time
Career Level
Senior
