SIEM/SOAR Engineer - Cloud Sec Spec 3

SIEM/SOAR Engineer (Cloud Sec Spec 3)

Location: Washington, DC

Work Authorization: US Citizen

Role Summary

The SIEM/SOAR Engineer builds and configures the Google SecOps SIEM/SOAR environment, ensuring ingestion pipelines, detections, playbooks, and automation workflows are fully operational and optimized for SBA’s enterprise security operations.

Roles & Responsibilities

· Configure ingestion pipelines and validate end‑to‑end log flow.

· Implement Google curated detections and build custom detection rules.

· Develop SOAR playbooks for SBA’s top incident categories.

· Integrate threat intelligence sources (Mandiant, Virus Total).

· Tune detections to meet false‑positive thresholds.

· Support UEBA dashboard configuration and risk scoring.

· Assist with runbook creation, analyst training, and operational transition.

Professional Experience Required

· 10+ years of experience with SIEM/SOAR platforms (Google SecOps preferred).

· Experience building detection rules, automation workflows, and parser validation.

· Experience with cloud telemetry ingestion (Azure, AWS, on-prem).

· Experience with threat intelligence integration.

Educational Qualification

· Bachelor’s degree in Cybersecurity, IT, or related field.

Certifications

· Google SecOps, GIAC, CISSP, or equivalent preferred.