Detection and SOAR Engineer, Mandiant Consulting, Google Cloud
Core
Build and maintain detection content, automation playbooks, and SIEM/SOAR configurations for client Cyber Defense Centers to enable effective incident detection and response.
Role type
Senior IC detection and SOAR engineer
Builds
SIEM use cases, SOAR playbooks, and automated response workflows for client SOC environments
Domain
Cybersecurity, Threat Detection, Incident Response
Required skills
SIEM tuning and content creation, SOAR automation and playbook development, scripting in Python or PowerShell, incident response operations, SIEM query languages (SPL, KQL, YARA-L), log aggregation and forwarding, Linux and network device logging
Preferred skills
Security certifications (CISSP, GCIH, GCFA, etc.), API integration for automation, advanced correlation searching, content engineering in SIEM platforms
Technologies
SIEM, SOAR, Python, PowerShell, SPL, KQL, YARA-L, Sigma, EDR, NDR
Responsibilities
Identify challenges in customer Cyber Defense Centers and formulate strategies for improvement, Create and modify SIEM use cases and SOAR playbooks, Engage with client stakeholders to drive resolution for security issues, Provide expertise for SOC technologies and surge support for analyst capabilities
