Senior Security Engineer with Google SecOps / Chronicle - Boston,MA - onsite - must be local

Job Title: Senior Security Engineer with Google SecOps / Chronicle

Location: Boston,MA - onsite

MustHave Skills (Hard Filters)

Use these as nonnegotiables:

• 5 years in SOC / SecOps / Incident Response, with at least 2 years focused on detection engineering.
• Direct handson with Google Security Operations (Google SecOps / Chronicle) for:
• Writing and tuning YARAL detection rules.
• Managing log sources and reference lists.
• Running investigations and hunts in SecOps.
• Proven DetectionasCode implementation:
• Detections stored as code in Git/GitHub (YAML/JSON or similar).
• Use of branches, pull requests, and code review for rule changes.
• CI/CD pipeline to test and deploy rules to Google SecOps (or another SIEM) not just manual uploads.
• Strong Python for security engineering:
• Building data parsers and enrichment scripts.
• Automating interactions with Google SecOps / SIEM / SOAR APIs.
• Implementing test harnesses for detections (synthetic logs, unit tests).
• Strong SOAR / playbook experience:
• Handson with Google SecOps SOAR or equivalent (Cortex XSOAR, Splunk SOAR, etc.).
• Built playbooks for phishing, suspicious logins, bruteforce, WAF events, including enrichment and containment steps.
• Solid L2/L3 SOC capability:
• Has led investigations for account compromise, ransomware, and webapp attacks.
• Comfortable owning incidents endtoend and communicating updates to stakeholders.
• Strong written and verbal communication in English, suitable for US customer calls and incident bridges.

If a CV does not clearly show Gitbased DaC Python SOAR L2 IR, it should not be considered