Senior Security Engineer

Job Title: Senior Security Engineer


Location: Boston


Client : Car Guru


Need senior resource


Check with these questions when sourcing candidate:

1. How do you test Detection-as-Code before deploying detections to production?
2. What is detection-as-code mean to you, and how have you used Git in this context?
3. You are building a SOAR playbook step that, when a "suspicious login" alert comes in, will:
   1. Call a threat-intel API (for example VirusTotal) to check the source IP reputation, and
   2. If the IP is "malicious", add a comment to the ticket and tag the alert as "High-Risk Source IP".
4. Sample YARA rule of a use case. He needs to run the coding for it.

Must-Have Skills (Hard Filters)


Use these as non-negotiables :

• 5+ years in SOC / SecOps / Incident Response, with at least 2+ years focused on detection engineering.
• Direct hands-on with Google Security Operations (Google SecOps / Chronicle) for:
  • Writing and tuning YARA-L detection rules.
  • Managing log sources and reference lists.
  • Running investigations and hunts in SecOps.
• Proven Detection-as-Code implementation:
  • Detections stored as code in Git/GitHub (YAML/JSON or similar).
  • Use of branches, pull requests, and code review for rule changes.
  • CI/CD pipeline to test and deploy rules to Google SecOps (or another SIEM) - not just manual uploads.
• Strong Python for security engineering:
  • Building data parsers and enrichment scripts.
  • Automating interactions with Google SecOps / SIEM / SOAR APIs.
  • Implementing test harnesses for detections (synthetic logs, unit tests).
• Strong SOAR / playbook experience:
  • Hands-on with Google SecOps SOAR or equivalent (Cortex XSOAR, Splunk SOAR, etc.).
  • Built playbooks for phishing, suspicious logins, brute-force, WAF events, including enrichment and containment steps.
• Solid L2/L3 SOC capability:
  • Has led investigations for account compromise, ransomware, and web-app attacks.
  • Comfortable owning incidents end-to-end and communicating updates to stakeholders.
• Strong written and verbal communication in English, suitable for US customer calls and incident bridges.

If a CV does not clearly show Git-based DaC + Python + SOAR + L2 IR, it should not be considered