Senior Staff Security Engineer, GCP Cyber Defense Center

There's no such thing as a "safe system" - only safer systems. Our Security team works to create and maintain the safest operating environment for Google's users and developers. As a Security Engineer, you help protect network boundaries, keep computer systems and network devices hardened against attacks and provide security services to protect highly sensitive data like passwords and customer information. Security Engineers work directly with network equipment and actively monitor our systems for attacks and intrusions. You also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

You use your industry experience to own and drive the resolution of complex security incidents, policy questions and technical security issues.

The mission of the Google Cloud Platform (GCP) Cyber Defense Center (GCDC) is to deliver unified security incident, vulnerability, and cloud-abuse management across Google Cloud.

By leveraging data-science-backed threat intelligence and working in close partnership across Google and Google Cloud, GCDC scales security operations to secure cloud infrastructure and mitigate customer-facing risks. The team ensures that critical security issues—ranging from zero-day vulnerabilities to sophisticated platform abuse—are rapidly triaged, resolved, and systemically remediated.

Ultimately, GCDC aligns with the broader Cloud CISO Security Engineering (CCSE) mission to "enable Cloud to grow securely" by making Google Cloud the most secure cloud platform and enabling product teams to make informed security risk decisions.

Google Cloud accelerates every organization’s ability to digitally transform its business and industry. We deliver enterprise-grade solutions that leverage Google’s cutting-edge technology, and tools that help developers build more sustainably. Customers in more than 200 countries and territories turn to Google Cloud as their trusted partner to enable growth and solve their most critical business problems.

Individual pay is determined by factors including job-related skills, experience, and relevant education or training.

US: $262000 - $364000 (USD) + 25% bonus target + equity + benefits

Learn more about benefits at Google.

Responsibilities

• Define, own, and drive the multi-year technical vision and strategy to modernize Google Cloud’s threat detection and incident response capabilities, preparing for the next wave of AI-driven attacks.
• Lead the development of unified security detection platforms and operational standards, driving widespread adoption of automated detection and response tools across all Cloud engineering teams.
• Pioneer and integrate advanced Artificial Intelligence (AI) and Machine Learning (ML) capabilities to accelerate threat detection and automate response.
• Architect novel approaches to identify systemic root causes of high-severity incidents, and drive cross-organizational programs to remediate them.
• Act as a technical leader for detection engineering across Google Cloud, providing architectural guidance and resolving the complex security escalations and architectural tradeoffs.

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.
  
• 10 years of experience with security assessments, security design reviews, or threat modeling.
• 10 years of experience in security engineering, software engineering, or a related technical discipline, with a focus on systems.
• Experience in designing, building, and securing cloud-based infrastructure and services.
• Experience in multiple security domains, particularly incident response, threat detection, network security, and data protection.

Preferred qualifications:

• Master's degree or PhD in Computer Science or a field related to systems or security engineering.
• Experience applying AI/ML to solve complex security problems, such as threat intelligence, anomaly detection, or automated response.
• Deep understanding of detection system design, architectural patterns, software failure modes, and development processes at scale.
• Ability to quickly assimilate new architectures, designs, and languages and to translate deep technical complexity into business outcomes for senior leadership.
• Recognized contributions to the security community, such as threat research, publications, open-source tools, or presentations at major security conferences.