Deputy Manager | Security Information and Event Management (SIEM) | Mumbai | Cyber Defense & Resilie

Deputy Manager | Security Information and Event Management (SIEM) | Bengaluru | Cyber Defense & Resilience

Experience: 6–8 Years

Location: Mumbai / Pune

Role Overview

We are looking for a skilled Google SecOps (Chronicle) Architect to design, implement, and optimize cloud-native SIEM solutions. The role focuses on building scalable security monitoring, detection, and response capabilities using Google Security Operations.

Key Responsibilities

• Lead architecture, design, and implementation of Google SecOps (Chronicle SIEM & SOAR) solutions


• Onboard and normalize security telemetry from multiple sources (cloud, network, endpoint, SaaS)


• Develop detection rules, use cases, and threat hunting queries using Chronicle Query Language (UQL/YARA-L)


• Design and optimize data pipelines, parsing, enrichment, and normalization strategies


• Integrate Google SecOps with security tools (EDR, IAM, firewalls, threat intel platforms)


• Implement and fine-tune alerting, correlation, and automated response workflows (SOAR)


• Perform threat hunting, incident investigation, and root cause analysis


• Ensure scalability, performance tuning, and cost optimization of SecOps platform


• Establish security best practices, governance, and compliance alignment


• Collaborate with SOC teams to improve detection coverage and reduce false positives


• Education: B.tech, B.E, BCA or any relevant qualification.

Required Skills

• Strong hands-on experience with Google SecOps (Chronicle SIEM/SOAR)


• Expertise in SIEM architecture, log management, and security monitoring


• Proficiency in detection engineering (YARA-L / UDM / UQL)


• Experience in data ingestion, parsing, and normalization (UDM model)


• Knowledge of security domains: network, endpoint, identity, cloud security


• Experience with cloud platforms, especially Google Cloud Platform (GCP)


• Understanding of threat frameworks (MITRE ATT&CK)


• Familiarity with APIs and automation


• Strong troubleshooting and performance optimization skills

Good to Have

• Google Professional Security Engineer or Chronicle certification


• Experience with SOAR playbooks and automation workflows


• Exposure to multi-SIEM environments (Splunk, QRadar, Sentinel, etc.)


• Programming/scripting knowledge (Python)


• Experience with DevSecOps and Infrastructure as Code (Terraform)