Senior Security Engineer

Role Overview

• Lead the end to end SOC alerts workflow.
• Operationalize the Regular Incident Response Plan and Major Incident Response Plan across teams.
• Own SOC tools and automation (with Google SecOps as the primary SIEM, SOAR, Google Threat Intelligence, Gemini AI integrations and Jira as the authoritative system of record).
• Coordinate with our managed SOC provider (Tier 1) to ensure, low noise of false positives, high quality triage, implementation of playbooks, clean escalations, and measurable MTTD/MTTR improvements.
• This is a hands on leadership role: you will design workflows and playbooks, lead investigations and RCA for high impact incidents, and mentor SOC Engineers and Analysts as we scale from a lean Phase 1 SOC (~2–3 FTE) to an AI enabled mature operations.
• Own the SOC alert lifecycle: Alert Ingestion → Triage → Routing → Investigation → Determination → Reporting.
• Act as Major Incident Manager (MIM) for security events meetings.
• Ensure strict adherence to Perforce’s Incident Response Policies for regular incidents.
• Maintain the SOC Charter, operating model, and guardrails as per the Operationalization Plan, Own the SOC RACI and routing matrix across SOC, CloudOps, IT, Engineering, and the provider.
• Lead design, configuration, and continuous tuning of Google SecOps (Chronicle SIEM + SOAR + case management, Google Threat Intelligence and Gemini integrations) as the primary detection and workflow platform.
• Design and implement automation to: o Enrich alerts (asset context, user context, historical activity). o Trigger Jira tickets and playbooks based on Google SecOps cases. o Support SLA monitoring and notifications (MTTR, remediation timeframes).
• Partner with the Corporate Security on CI/CD and IaC security automation where incident workflows intersect with pipelines (e.g., auto ticketing, auto asset tagging, config drift etc..).
• Define and own a core set of playbooks aligned to IRP/MIRP. o Cloud misconfiguration / CSPM alerts. o Endpoint malware / suspicious activity. o Identity/credential compromise. o Application / product security alerts. o External threat reports via Security Mailbox or any other threat feeds.
• Oversee False Positives and Exceptions processes.
• Own SOC KPIs and operational metrics.
• Produce and present the Monthly SOC Summary Report.
• Lead RCA and post incident reviews.
• Champion a culture of continuous improvement.
• Act as day to day lead and senior escalation point for SOC Engineers and Analysts in Pune.
• Coach and mentor team members on process adherence and effective alert handling.
• Build strong partnerships with vendors, partners and stake holders, Serve as primary liaison with the Tier 1 provider.

Requirements

• Bachelor’s or master’s degree in computer science, Information Security, Engineering, or related field.
• 8+ years of experience in Security Operations, Incident Response, or SOC roles, including: o 2+ years in a lead or senior engineer capacity. o Proven experience working with managed SOC providers.
• Deep hands on experience with: o SIEM / security analytics platforms (Google SecOps / Chronicle strongly preferred or equivalent). o Case and ticket workflows integrated with Jira or other ITSM platforms.
• Strong background in incident response aligned with NIST/ISO: o Demonstrable experience running containment, eradication, recovery, and post incident RCA. o Experience coordinating Major Incidents involving multiple teams.
• Solid understanding of: o Cloud platforms Security (AWS, GCP, Azure) and their logging/monitoring stacks. o Endpoint security (Microsoft Defender or equivalent). o Common attacker TTPs across infrastructure, endpoints, and SaaS. o Hands-on Experience with: Security automation (Python/Go/Ruby, SOAR, API based integrations), SIEM and SOAR tools (e.g., Google Sec-Ops, Tenex, Q-radar etc.).
• Ability to interpret and operationalize written processes and RACI models.
• Certifications such as GCIA, GCED, GCIH, GCDA, GCFA, CISSP, CCSP, or similar.
• Experience in a global SaaS or multi product organization, Prior experience leading or actively participating in SOC2 or ISO 27001 audit evidence collection.

Tech Stack

• AWS
• Azure
• Cloud
• Google Cloud Platform
• ITSM
• Python
• Ruby
• Go

Benefits

• All employees are expected to demonstrate AI fluency appropriate to their role and level, including responsible use of AI tools, sound judgment, and adherence to company AI governance and security policy standards.
• Come work with us! Our team members are valued for their contributions, introduced to new opportunities, and rewarded well.
• Perforce combines the experience and rewards of a start-up with the security of an established and privately held profitable company.
• If you are passionate about the technology that impacts our day-to-day lives and want to work with talented and dedicated people across the globe, apply today!