• Comply with currently mandated national and DoD-approved policies, directives, architectures, programs, standards, and guidelines. • Design, implement, and sustain security telemetry/logging architecture in GCP, ensuring high-fidelity signals are collected, normalized, and delivered to the VDSS/SIEM/SOAR stack. • Own logging coverage and quality for cloud and platform signals, including: Cloud Audit Logs (Admin Activity, Data Access, System Event) • IAM/service account activity and privileged actions • VPC Flow Logs, load balancer/WAF/proxy signals • GKE audit logs and Kubernetes control-plane events • Security-relevant application/service logs • Build detection engineering content: queries, correlation logic, alert rules, and dashboards aligned to cloud threat scenarios (IAM abuse, suspicious API usage, workload compromise, data access anomalies, lateral movement paths). • Develop automation and guardrails to reduce toil and accelerate investigations/response: API-driven enrichment and evidence capture (e.g., asset inventory, IAM bindings, network path/context, log exports) • Repeatable runbooks/workflows and integration into ticketing/notification pipelines • Partner with teams to implement and validate security controls that improve defensibility: Secure configuration baselines and drift detection • Identity and access telemetry improvements • Network segmentation signals and policy validation • Container/GKE security instrumentation and runtime visibility • Execute continuous control-health checks and instrumentation validation (telemetry completeness, parsing quality, alert fidelity, logging pipeline reliability). • Coordinate cleanly with the CSSP: provide engineered signals, detection content, and automation that improves downstream monitoring and response outcomes. • Produce clear technical deliverables (engineering notes, detection documentation, dashboards/coverage maps, stakeholder-ready updates) with minimal editing.