Key responsibilities

- Monitor and investigate alerts and cases in Google SecOps, validate severity, determine scope and root cause, and document evidence-based conclusions.

- Create, test, tune, and maintain YARA-L detection rules, reference lists, dashboards, searches, and alerting logic mapped to MITRE ATT&CK.;

- Onboard and validate security telemetry using forwarders, collectors, APIs, connectors, parsers, and the Unified Data Model (UDM).

- Use Google SecOps search, graph investigation, case management, Gemini-assisted workflows, and threat intelligence to accelerate investigations.

- Develop and maintain SOAR playbooks for enrichment, containment, ticketing, notification, and evidence collection with appropriate approval gates.

- Triage data-quality, parsing, timestamp, field-mapping, duplication, and ingestion issues and coordinate remediation with source owners.

- Perform alert tuning and use-case health reviews to improve precision, reduce false positives, and maintain coverage for high-risk attack techniques.

- Support major incidents, threat hunts, post-incident reviews, lessons learned,



and creation of recent detections from observed attacker behavior.

- Maintain operational documentation and track SOC measures such as MTTD, MTTR, alert disposition, use-case effectiveness, and ingestion health.

Essential qualifications and expertise

- 5-8 years of cybersecurity experience, including at least 3 years in SOC monitoring, incident investigation, SIEM engineering, or detection content development.

- Hands-on Google SecOps experience covering UDM search, YARA-L, cases, detections, log onboarding, dashboards, and SOAR playbooks.

- Working knowledge of Windows, Linux, identity, endpoint, network, cloud, email, and application telemetry.

- Ability to analyze raw logs, security events, process trees, authentication activity, network connections, and threat intelligence.

Preferred qualifications

- Google Cloud security or Google SecOps certification/training, Security+, CySA+, or equivalent.

- Experience with Python and automation of repeatable SOC tasks.

📌 Walk-in || Deloitte_Walk-In Drive_Cyber_Gurgaon_ Google Security Operations (Delhi)
🏢 Deloitte Shared Services India
📍 Delhi