SIEM Engineer

This is a fully remote position, open to applicants in Kansas, +1 more state.

📋 Description

• Establish, implement, and uphold the organization's security monitoring and detection capabilities within Google SecOps.

• Craft, execute, and sustain the Google SecOps platform, encompassing log ingestion, parsing, normalization, and enrichment across cloud, on-premises, SaaS, and security data sources.

• Integrate, validate, and oversee new log sources within Google SecOps.

• Guarantee accurate mapping to the Unified Data Model (UDM), telemetry coverage, parser performance, and platform health.

• Create Google SecOps dashboards, operational metrics, and reports for security monitoring, compliance, audits, and executive reviews.

• Design and maintain automated investigation and response workflows utilizing Google SecOps.

• Support the development, tuning, and upkeep of YARA-L detection content in line with MITRE ATT&CK techniques.

• Mitigate false positives to enhance detection accuracy.

• Collaborate with Incident Response and Security Architecture teams to facilitate detection, investigation, and response to cybersecurity threats across the organization.

• Employees are responsible for their own transportation to and from home and office, including necessary events, meetings, and training.

⛳️ Requirements

• A Bachelor’s degree from a four-year college or university in a computer-related field and 5+ years of experience in information security, focusing significantly on security operations, or an equivalent combination of education and technical expertise.

• Practical experience administering Google SecOps (Chronicle) or a comparable enterprise SIEM platform.

• Hands-on experience with cloud security monitoring across AWS, Azure, or Google Cloud Platform.

• Knowledge of security operations, threat hunting, and detection engineering practices.

• Strong understanding of security telemetry collection, log parsing, and data normalization.

• Proficient in threat detection, alert triage, and incident response.

• Well-versed in MITRE ATT&CK and contemporary adversary tactics, techniques, and procedures.

• Capability to articulate complex security concepts clearly to both technical and non-technical audiences.

• Familiarity with developing detection content using YARA-L and Unified Data Model (UDM) as well as investigating security incidents.

• Practical experience with Endpoint Detection & Response (EDR/XDR) and Threat Intelligence Platforms.

• Residency within a 100-mile radius of the Kansas City, MO office is mandatory.

• Applicants must possess authorization to work for any employer in the U.S.

• Relevant certifications such as CISSP, GCIH, GCIA, and Security+ are preferred.

• Experience with UDM and custom parser development is preferred.

• Familiarity with the NIST Cybersecurity Framework is preferred.

• Experience with Google SecOps SOAR and playbook development is preferred.

• Experience managing and implementing OpenTelemetry Collectors is preferred.

• Experience with Windows Event Logging and Sysmon is preferred.

• Familiarity with systems and technologies such as Slack, Atlassian Jira, AWS, Microsoft Azure, Windows, Linux, MacOS endpoints, and Microsoft Suite.

🏝️ Benefits

• Full-time remote position.

• No overnight business travel required.

• Equal Opportunity Employer.