Implementation Engineer for Yandex Cloud's Security Products Team

Yandex Cloud is actively developing security products for external clients. Currently, there is significant interest in our SIEM and SOC services – the product was launched in April and is already generating considerable buzz. This means we need not just to maintain interest, but to build systematic work with clients during the pre-sales and pilot stages.

We are looking for an architect who will take charge of the technical aspects of this process. Your task will be to understand client needs, design a suitable solution architecture, and guide it through the pilot phase to industrial operation. This requires a deep dive into both client challenges and product capabilities. In your work, you will closely collaborate with SOC, implementation, development, and product teams.

What Tasks Await You

Coordinating the Technical Side of Pilots You will be the "owner" of the technical scope for pilot projects. This means you will be responsible for defining its goals, architecture, and data sources, as well as establishing readiness criteria. Your tasks include preparing a technical plan, coordinating data source integration, monitoring data quality, identifying integration limitations, and organizing interaction between the client and internal teams.

Participating in Monitoring Scenario Development Together with the SOC team, you will help clients identify relevant threats and the data sources needed for their detection. It’s important not just to gather requirements, but to connect client needs with product capabilities into a cohesive solution. You will need to understand how areas of responsibility are divided and how incident escalation will be structured.

Developing Standard Materials We are committed to making processes efficient. Based on project outcomes, you will create materials that will accelerate future pre-sales and pilot launches: standard architectures, checklists, project templates, and demonstration scenarios.

We Expect You To Have

• At least three years of experience with SIEM, SOC, or information security monitoring projects in roles such as architect, pre-sales engineer, implementation engineer, or SOC specialist.
• Participated in the design, implementation, or industrial operation of SIEM.
• Understand the processes of monitoring, alert processing, incident investigation, and response.
• Familiarity with at least one of the common SIEM platforms (KUMA, MaxPatrol SIEM, ArcSight, Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security, Wazuh, or similar).
• Expertise in the architecture of collecting, transmitting, processing, and storing security events, and experience working with logs (Syslog, JSON, CEF, LEEF).
• Ability to write search and analytical queries in languages such as KQL, SPL, PDQL, or similar.
• Capability to design technical solutions and document them in the form of clear architectural diagrams and documents.
• Ability to explain complex technical issues to both engineers and managers.
• Independently manage tasks and coordinate the work of clients, sales, SOC, and development teams.
• English proficiency sufficient for reading technical documentation.

It Will Be a Plus If You Have

• Experience as an analyst, architect, or head of an SOC unit.
• Participation in SIEM performance evaluation, EPS calculation, or storage volume estimation.
• Experience creating PMMs (Product Marketing Materials), technical specifications, and presenting at conferences or webinars.
• Familiarity with MITRE ATT&CK and the ability to link monitoring scenarios to attack techniques.
• Experience with cloud infrastructure on Yandex Cloud, AWS, Azure, or Google Cloud.
• Understanding of monitoring requirements for hybrid infrastructure and containerized environments (Kubernetes, Docker).
• Familiarity with Kafka, Logstash, Fluent Bit, Vector, Beats, or other event delivery tools.
• Ability to automate tasks using Python, Bash, API, or CLI.
• Familiarity with Russian regulatory requirements for event logging and incident response.

More About the Team

We are building a unified security monitoring domain where SIEM, SOC service, detection, and investigation function as interconnected parts of a single system. The team includes close collaboration between developers, product managers, SOC analysts, and other architects.

You can directly influence the product here: feedback from clients and pilot results become the foundation for developing the architecture and detection rules. You won't just be communicating with clients; you'll be involved in creating a cloud-based security monitoring platform – from its initial large-scale deployments to establishing standards for its industrial operation. We are looking for someone who shares our passion, is ready to take responsibility for their results, and enjoys the process.