Security Operations

• Monitor and triage alerts across Google Security Operations (Chronicle) and the Foresite ticketing queue for assigned customer environments during your shift.
• Investigate Tier 1 incidents end-to-end: review alert context, gather evidence from Chronicle UDM and supporting tools, reach an initial disposition, and either close the ticket with a documented rationale or escalate as needed with a clear handoff.
• Follow established investigation playbooks for the top alert types and rule categories in our detection stack, and flag gaps or outdated guidance to your Team Lead for improvement.
• Communicate clearly in tickets. Every ticket you touch should be understandable by the next analyst, the customer, or an auditor reading it six months from now. Your written analysis is the primary artifact of your work.
• Partner with customers through the ticketing system on routine investigations, requests for information, and exclusion/suppression requests under Team Lead oversight.
• Meet SLA and quality targets for first-touch time, triage accuracy, and ticket closure quality as defined in the L1 performance scorecard.
• Participate in shift handoff — brief the incoming analyst on open investigations, anomalies observed during your shift, and anything waiting on customer response.
• Contribute to detections fidelity by flagging noisy rules, false-positive patterns, and alert clusters that should be reviewed by the detection engineering team.

See all jobs on JobTailor

SOC Analyst I