Lead Security Operations Center Analyst

Must Have Technical/Functional Skills:

SIEM Technologies

Google SecOps (Chronicle) SIEM, Security Event Monitoring, Log Analysis and Correlation, Detection Engineering, Use Case Development

SOAR Technologies

Google SecOps SOAR, Security Orchestration and Automation, Playbook Development, API Integrations, Workflow Automation

Security Domains

Incident Response, Threat Intelligence, Threat Hunting, Endpoint Security, Cloud Security, Vulnerability Management

Roles & Responsibilities

Technical:

Perform investigation and escalation for complex or high severity security threats or incidents

Security monitoring experience with one or more SIEM technologies Google SecOps SIEM (preferable), Splunk.

Conduct multi-step breach and investigative analysis to trace the dynamic activities associated with advanced threats

Work with SIEM Engineering and other security partners developing and refining correlation rules

Create and develop SOC processes and procedures working with Level 3, Level 2 and Level 1 Analysts

Drive Use Case Roadmap development and Use Case validation

Perform regular threat hunting utilizing security tools and intelligence information to identify and remediate potential security threats

Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs)

Maintain and drive the development of new reports of Cyber Threat Intelligence analysis and making threat intelligence actionable

Google SecOps Administration & Engineering

Configure, administer, and maintain Google SecOps SIEM and SOAR platforms.

Onboard and validate log sources from security, cloud, network, endpoint, IAM, and application environments.

Develop and tune correlation rules and detection use cases.

Configure threat detection content aligned with MITRE ATT&CK techniques.

Configure parsers, ingestion pipelines, and data normalization.

Develop and optimize detection rules, correlation rules, dashboards, and alerts.

Support log source integrations and ensure data quality and visibility.

Perform health checks and platform tuning to improve detection efficiency.

Coordinate with security tool owners and infrastructure teams for log enablement and troubleshooting.

SOAR & Security Automation

Design, develop, and maintain SOAR playbooks and automated response workflows.

Integrate Google SecOps with security tools and third-party platforms.

Automate repetitive SOC tasks, incident enrichment, and response activities.

Configure orchestration workflows for malware, phishing, IAM, cloud, and endpoint incidents.

Improve SOC efficiency through continuous automation initiatives.

Threat Detection & Threat Intelligence

Monitor threat intelligence feeds and external security advisories.

Tune detection logic is based on emerging threats and attack techniques.

Configure and manage threat intelligence integrations and reputation feeds.

Perform threat hunting activities utilizing SIEM and endpoint telemetry.

Provide proactive threat advisories and recommendations to stakeholders.

Analyze suspicious activities and identify security incidents.

Classify incidents according to severity and business impact.

Support incident response, containment, eradication, and recovery activities.

Coordinate with infrastructure, network, cloud, IAM, and endpoint teams during investigations.

Reporting & Governance

Prepare weekly and monthly SOC operational reports.

Generate incident metrics, SLA reports, and executive dashboards.

Maintain SOC runbooks, operational procedures, use-case documentation, and knowledge repositories.

Participate in audits, compliance reviews, and security assessments.

SIEM Technologies

Google SecOps (Chronicle) SIEM

Security Event Monitoring

Log Analysis and Correlation

Detection Engineering

Use Case Development

SOAR Technologies

Google SecOps SOAR

Security Orchestration and Automation

Playbook Development

API Integrations

Workflow Automation