Google Cloud Security Operations Engineer

Security tools hold the most sensitive data in the company. You give analysts and engineers the minimum access, authenticate through the workforce provider, and audit use of the platform itself.

• Roles for analysts, engineers and administrators
• Workforce identity for security tooling
• Service accounts for integrations
• Audit logs for tool use
• Data access boundaries between teams
• Reviewing access regularly

You build An access model for a security operations team with audited roles.

Detection starts with data. You choose how logs reach the platform, from cloud sources, endpoints and network devices, and balance coverage against ingestion cost.

• Cloud, endpoint, identity and network log sources
• Ingestion methods: feeds, forwarders and APIs
• Prioritizing sources by detection value
• Filtering and controlling ingestion cost
• Retention and storage tiers
• Verifying that data arrives completely

You build An ingestion plan that prioritizes sources and keeps cost inside a stated limit.

Rules only work on data that is shaped consistently. You write and tune parsers, map fields to the common event model, and fix the parsing faults that make detections silently fail.

• How parsers turn raw logs into events
• Mapping to the Unified Data Model
• Writing and testing parser logic
• Handling new log formats and changes
• Detecting parsing errors
• Keeping parsers under version control

You build A parser for a new log source, with tests and field mapping.

A login is only suspicious in context. You build context about users, assets and entities, enrich events with it, and establish baselines so deviations stand out.

• Asset and user context sources
• Entity relationships and aliases
• Enriching events with context
• Reference lists for known good and known bad
• Baselines of normal behavior
• Keeping context current

You build An enriched entity context for users and assets with a baseline for one behavior.

Hunting finds what rules missed. You form hypotheses, search logs in Logs Explorer, BigQuery and the SecOps platform, use threat intelligence and indicators of compromise, and hunt back through history.

• Forming and testing hunting hypotheses
• Searching with Logs Explorer and BigQuery
• Indicators of compromise and retroactive search
• Using threat intelligence in hunts
• Spotting anomalies in authentication and network data
• Documenting hunts and turning them into detections

You build Three documented hunts, each ending in a finding or a new detection idea.

Good detection rules catch real attacks without drowning analysts. You write rules in YARA-L, use entity data and threat intelligence for precision, apply risk-based alerting and cut false positives.

• Rule structure and event matching in YARA-L
• Multi-event and sequence rules
• Reference lists and entity context in rules
• Risk-based alerting and scoring
• Testing rules against historical data
• Reducing false positives

You build A set of tested detection rules for five attack techniques with measured alert volume.

Under pressure, order of action matters. You triage alerts, gather and protect forensic evidence, work out scope and root cause, and contain incidents without destroying what you need.

• Triage and prioritization
• Collecting and preserving forensic evidence
• Scoping an incident with log searches
• Root cause analysis
• Containment actions in Google Cloud
• Closing an incident and recording lessons

You build An investigation report with timeline, scope, root cause and containment steps for a simulated incident.

Repeatable steps should run on their own, and humans should handle the rest. You build playbooks that enrich, decide and act, and manage cases through escalation and handoff.

• Playbook structure, triggers and actions
• Enrichment and automated response steps
• Human approval and escalation points
• Case lifecycle and severity
• Shift handoff and documentation
• Testing and maintaining playbooks

You build A playbook that enriches, scores and contains a phishing-related alert, with a case workflow.

Leaders judge security by what they can see. You build dashboards for analysts and managers, report on detection and response measures, and present security telemetry in Looker Studio and platform dashboards.

• Choosing measures for operations and leadership
• Dashboards in the security platform
• Reporting with Looker Studio
• Trends: volume, time to detect and time to respond
• Sharing reports with the right audience
• Keeping dashboards honest

You build An analyst dashboard and a monthly management report built from security data.

A silent log source looks like a quiet network. You monitor ingestion, parsers and integrations with Cloud Monitoring, and alert when a source goes dark or a tool fails.

• Monitoring ingestion volume and latency
• Silent source alerts
• Monitoring parsers and detection rules
• Integration and playbook failure alerts
• Capacity and quota monitoring
• Operating procedures for stack outages

You build A health monitoring setup that alerts on silent sources and failing integrations.

Run the whole cycle on one environment. You ingest and parse data, write detections, hunt, handle an incident through a playbook and report results, then check the health of the platform behind it.

• Setting up sources and context
• Writing detections and hunting
• Responding to a simulated attack with a playbook
• Reporting results
• Reviewing platform health and gaps

You build A working detect, hunt, respond and report workflow for one simulated attack.