SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Zimperium is the world leader in mobile security, delivering AI-driven, on-device protection for mobile applications and devices. We are seeking a Senior SOC Engineer to own and operate our Google SecOps platform end-to-end as a hands-on individual contributor.
In this role, you will architect log ingestion pipelines, author and tune threat detection rules, design AI-powered triage and response automation, integrate our CNAPP platform with security operations workflows, and lead investigative response to high-severity incidents. You will execute the work yourself rather than managing others—owning detection strategy, platform architecture, automation design, and incident response quality. You will be the technical leader your team relies on when new log sources need ingestion, detection rules require debugging, or complex incidents demand investigation.
Key responsibilities include:
- Orchestrating data flow from Zimperium's CNAPP platform into Google SecOps and other security tools, building integrations to coordinate threat notifications and enable unified response across mobile and cloud/infrastructure security.
- Owning and maintaining Google SecOps as the operational hub—SOAR workflows, alert routing logic, case management, automation rules, integrations with ticketing systems (Jira), notification channels, and escalation procedures.
- Leading investigations into high-severity and complex incidents, conducting root cause analysis, determining scope and impact, coordinating containment and remediation, and producing clear post-incident reports.
- Writing or adapting tools and scripts (Python, Go, Bash) to automate SOC workflows—bulk event analysis, data enrichment, response actions, and reporting.
- Defining, instrumenting, and owning SOC KPIs—detection latency, mean time to respond (MTTR), investigation duration, false positive rate, and automation coverage. Building dashboards and reports for leadership.
- Serving as incident commander or key investigator for high-priority events, driving incidents to root cause.
- Generating evidence and documentation for security audits (ISO 27001, FedRAMP) and translating technical findings into auditor-readable format.
You will work in close collaboration with DevOps, Cloud Security, and Product Security teams, operating independently, making architectural decisions, and exercising sound judgment without direction.
Requirements:
- 8+ years in security operations, threat detection, or incident response, with at least 4 years in a SIEM/SOC engineering or detection engineering role.
- Deep hands-on experience with at least one major SIEM platform (Splunk, ELK, Chronicle/Google SecOps, Sentinel, Sumo Logic).
- Production experience with detection authoring and tuning.
- Strong understanding of log types and sources—OS logs, application logs, network flow, DNS, proxy, endpoint telemetry, CNAPP/runtime security events.
- Experience building or tuning threat detection rules and correlation logic.
- Working knowledge of attack frameworks (MITRE ATT&CK) and how to operationalize them.
- Proficiency in at least one scripting/programming language (Python, Go, Bash) sufficient to build and maintain automation.
- Experience integrating security tools—APIs, webhooks, orchestration platforms (Zapier, Make, native SOAR).
- Hands-on incident investigation experience—evidence collection, root cause analysis, timeline reconstruction, scope determination.
- Familiarity with mobile threat detection, CNAPP, or endpoint threat detection.
- Strong written and verbal communication—ability to explain technical findings to non-technical stakeholders and brief executives on incidents and trends.
- Proven ability to operate independently, take ownership, and make decisions with sound judgment.
Preferred Qualifications:
- Prior experience with Google Chronicle, Google SecOps, or similar cloud-native SIEM platforms.
- Experience with AI/ML-based alert triage, anomaly detection, or automated incident response.
- Experience operating in regulated or compliance-heavy environments—FedRAMP, DoD, PCI-DSS, HIPAA.
- Hands-on experience with mobile threat detection, mobile app security, or container/Kubernetes runtime security.
- Experience with threat modeling, vulnerability disclosure coordination, or security research.
- Relevant certifications (GCIH, ECIH, OSINT, GIAC certifications, or vendor-specific: Google Cloud Security, AWS Security, etc.).
- Prior DevSecOps, security engineering, or cloud security experience.
- Background in building systems.
