Site Reliability Engineer (Google Cloud Platform)
Full-time
USA - Must Work EST (8:30AM - 5:30PM)
Remote
U.S Citizen
Primary Purpose and Goal of Role
The Site Reliability Engineer (Google Cloud Platform) is a hands-on engineering role focused on designing, operating, and securing GCP environments that protect Controlled Unclassified Information (CUI) for federal and regulated customers. This position applies to an SRE approach to build secure landing zones, network and identity controls, encryption, logging, and detection capabilities while using automation-first practices to ensure environments remain reliable, secure, and repeatable. The role owns provisioning, configuration, observability, and incident response for production GCP environments and reduces operational toil by codifying infrastructure rather than relying on manual console work. Success requires deep practical GCP expertise, working knowledge of NIST SP 800-53, NIST SP 800-171, FedRAMP, and CMMC, and the ability to map security requirements to GCP configurations and audit-ready evidence. This position supports federal CUI environments and requires an active U.S. government Secret security clearance.
Responsibilities
- Design, build, and operate secure GCP cloud foundations and landing zones for federal and regulated environments, including organization hierarchy, policy guardrails, Assured Workloads, and Cloud Foundation Toolkit-based deployment patterns
- Engineer and maintain secure GCP network architectures, including Shared VPC, hub-and-spoke topology, VPC Service Controls, Access Context Manager, Private Google Access, Private Service Connect, Cloud NGFW, Cloud Armor, load balancing, DNS, NAT, VPN, and Interconnect under least-exposure principles
- Implement and administer identity, access, privileged access, and encryption controls, including least-privilege IAM, custom roles, IAM Conditions, deny policies, service-account hygiene, Workload Identity Federation, Privileged Access Manager, Access Approval, Access Transparency, BeyondCorp Enterprise, IAP, Cloud KMS, Cloud HSM, CMEK, and Cloud EKM
- Develop and operate security monitoring, threat detection, and response capabilities using Chronicle/Google Security Operations, Security Command Center, curated detections, YARA-L, threat intelligence, SOAR playbooks, telemetry pipelines, and integration with MDR/SOC workflows
- Build and maintain logging, audit, observability, and reliability capabilities using Cloud Audit Logs, aggregated log sinks, retention policies, BigQuery/Chronicle exports, Cloud Monitoring, Cloud Logging, dashboards, uptime checks, SLIs/SLOs, alerting, on-call operations, incident response, and blameless postmortems
- Secure and operate cloud workloads and platforms, including Sensitive Data Protection/Cloud DLP for CUI discovery and de-identification, hardened GKE environments, Workload Identity, Shielded/Confidential nodes, network policy, GKE Policy Controller, Binary Authorization, and secure Artifact Registry image promotion
- Automate infrastructure, security, compliance, and reliability operations using Terraform, Infrastructure Manager, Cloud Foundation Toolkit, policy-as-code, secure CI/CD pipelines, Cloud Build, Cloud Deploy, and scripting in Python, Go, or Bash to reduce manual work and operational toil
- Translate federal security and compliance requirements into GCP configurations and audit-ready evidence, including NIST SP 800-53, NIST SP 800-171, FedRAMP, CMMC, control inheritance, customer responsibility matrices, RMF/FedRAMP authorization support, and assessor/AO documentation
- Partner directly with customers and internal stakeholders to communicate technical requirements, operational risks, compliance expectations, and implementation status to both technical and non-technical audiences
REQUIREMENTS
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field preferred, or equivalent experience
- Minimum 5+ years in IT infrastructure, cloud, or security engineering, including 3+ years hands-on with Microsoft Azure
- Minimum 2+ years with Microsoft Sentinel or a comparable enterprise SIEM, including data-source onboarding
- Strong working knowledge of the Microsoft security stack (Sentinel, Defender XDR, Entra ID, Azure Monitor / Log Analytics) and multi-tenant delegated access (Azure Lighthouse, GDAP)
- Hands-on experience onboarding a wide range of data sources (identity providers, endpoints, firewalls and network devices, SaaS applications, Syslog/CEF, API, and agent-based integrations) from Azure, AWS, and Google Workspace / Google Cloud
- Experience working across multiple SIEM platforms, such as Microsoft Sentinel, Splunk, SentinelOne, IBM QRadar, or similar
- Proficiency in KQL and scripting (PowerShell or Python), with solid troubleshooting skills across Windows, Linux, networking, and identity
- Preferred: prior MSSP, MDR, or security consulting experience; experience supporting federal or defense-industrial-base customers, including GCC and GCC High environments; and experience with EDR/XDR platforms such as CrowdStrike or SentinelOne
- Minimum at least one current certification required: AZ-500 or SC-200
- Strong written and customer-facing communication skills
Quzara LLC is an Equal Employment/Affirmative Action employer. We do not discriminate in hiring based on sex, gender identity, sexual orientation, race, color, religious creed, national origin, physical or mental disability, protected Veteran status, or any other characteristic protected by federal, state, or local law.