Google SecOps Engineering Lead

Key Responsibilities

1. Technical Leadership & Platform Engineering

• Architecture & Strategy: Oversee the end-to-end architecture of the Google SecOps platform, including data ingestion pipelines (UDM), storage, and multi-cloud integrations.
• Detection Engineering: Guide the team in developing sophisticated detection logic using YARA-L or UDM and managing the lifecycle of detections to reduce false positives, increase true positives, nullify false negatives, and broaden the coverage of MITRE ATT&CK.
• SOAR Automation: Lead the design and implementation of automated incident response playbooks to reduce Mean Time to Respond (MTTR) and manual routing or mundane efforts.
• Continuous Improvement: Drive the adoption of security operations principles to ensure the platform is meeting the engineering requirements of the SOC & IT.
• Solution Customization: Ability to design and implement workarounds for technical issues, and ability to develop and implement customization to meet the delivery requirements.
• E2E Management: Ability to manage the Google SecOps platform End-to-End along with the required project management in Google Cloud Platform.

2. People Management & Team Development

• Mentorship: Act as a technical mentor to senior and junior engineers, conducting deep-dive code/logic reviews and architectural assessments.
• Talent Growth: Manage performance cycles, career development plans, and hiring to build a diverse, world-class SecOps engineering team.
• Culture: Foster a "blameless" engineering culture focused on iterative learning, automation over manual effort.

3. Delivery & Value Realization

• Roadmap Management: Translate business, operational and functional requirements into technical deliverables and ensure the timely delivery of engineering items.
• Stakeholder Alignment: Collaborate with SOC Leads, CISO office, and different IT teams to ensure the platform meets operational needs.
• Metric-Driven Output: Define and report on key performance indicators (KPIs) such as data ingestion health, detection coverage (MITRE ATT&CK mapping), and automation ROI.