4 days ago
Sydney, AustraliaMid Level
Responsibilities
- Onboard and migrate log sources into Google SecOps, including ingestion, parser development, field extraction, UDM mapping, normalization, validation, and operational handover.
- Develop and maintain custom parsers, ingestion scripts, services, exporters, integrations, and security telemetry transformation and enrichment logic.
- Configure, troubleshoot, and optimize data pipelines across GCP and Azure, including ingestion quality, capacity, entitlement, cost, and performance concerns.
- Create, test, review, deploy, and tune YARA-L detection rules and map detection content to MITRE ATT&CK.
- Manage platform configurations and detection content as code using Git-based workflows, pull requests, peer review, version control, and automated deployment pipelines.
- Support migrations from Splunk and other SIEM platforms by mapping and validating rules, alerts, dashboards, data sources, and detection use cases.
- Provide technical input in customer workshops and reviews and produce solution designs, onboarding guides, test evidence, operating procedures, and runbooks.
Requirements
- At least 3 years of cybersecurity engineering experience, including substantial SIEM engineering exposure.
- Hands-on Google SecOps (Chronicle) engineering experience, including parser and field extraction development.
- Experience with data ingestion, UDM mapping, normalization, validation, custom log-source onboarding, and security telemetry quality management.
- Experience writing and tuning YARA-L detection rules and applying MITRE ATT&CK and security detection engineering practices.
- Working knowledge of GCP and Azure, including cloud-native logging and hybrid data flows.
- Hands-on experience with Git-based engineering and CI/CD pipelines.
- Ability to develop or maintain automation and ingestion components using Python or a similar scripting language.
- Proven experience delivering customer-facing security engineering projects, with strong troubleshooting, documentation, stakeholder communication, and client delivery skills.
- Preferred experience includes BindPlane, APIs, cloud-native exporters, data transformation, telemetry enrichment, detection-as-code, configuration-as-code, infrastructure-as-code, SOC operations, and large-scale security transformation programs.
- Preferred qualifications include Google Cloud Professional Cloud Security Engineer certification and relevant Google SecOps or Chronicle accreditation or training.
Tech Stack
Categories
About Cognizant
Cognizant is a public IT services and consulting firm that designs, builds, and runs enterprise technology, including digital engineering, cloud modernization, data/AI, and managed services. It sells consulting, systems integration, and outsourcing on multi-year engagements to large enterprises in healthcare, banking, retail, communications, and manufacturing. Founded in 1994 and headquartered in Teaneck, New Jersey, Cognizant is NASDAQ-listed (CTSH) and a Fortune 500 company.