Senior Security Developer, Google Threat Intelligence Group

About the job

There's no such thing as a "safe system" - only safer systems. Our Security team works to create and maintain the safest operating environment for Google's users and developers. As a Security Engineer, you help protect network boundaries, keep computer systems and network devices hardened against attacks and provide security services to protect highly sensitive data like passwords and customer information. Security Engineers work directly with network equipment and actively monitor our systems for attacks and intrusions. You also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

You use your industry experience to own and drive the resolution of complex security incidents, policy questions and technical security issues.

As a Senior Security Developer on our team, you will conduct in-depth research on threat groups, their tactics, techniques, and procedures (TTPs), and the malware they employ. You will utilize Google's powerful internal intelligence platforms, to model threat activity and generate actionable insights. You will have close collaboration with various teams to develop and implement effective countermeasures, contributing directly to threat disruption and enhancing our collective security posture. You will be passionate about threat research to lead projects and mentor others. Google Cloud accelerates every organization’s ability to digitally transform its business and industry. We deliver enterprise-grade solutions that leverage Google’s cutting-edge technology, and tools that help developers build more sustainably. Customers in more than 200 countries and territories turn to Google Cloud as their trusted partner to enable growth and solve their most critical business problems.Individual pay is determined by factors including job-related skills, experience, and relevant education or training.

Canada: $182000 - $187000 (CAD) + 15% bonus target + equity + benefits Germany: €128000 - €132000 (EUR) + 15% bonus target + equity + benefits Spain: €92000 - €94500 (EUR) + 15% bonus target + equity + benefits France: €104000 - €107000 (EUR) + 15% bonus target + equity + benefits Italy: €90000 - €92500 (EUR) + 15% bonus target + equity + benefits US: $174000 - $253000 (USD) + 15% bonus target + equity + benefits

Learn more about benefits at Google . Responsibilities

Own, prioritize, and drive the tracking of complex, financially motivated threat actors (e.g., ransomware, extortion) and associated research projects.

Lead complex technical analyses, modeling threat activity, tactics, techniques, and procedures (TTPs), and indicators of compromise (IOCs) across internal platforms.

Create and deploy detection signatures to maintain visibility over threat actors and assist in closing security gaps.

Produce polished, high-quality technical intelligence documentation and actor profiles to deliver actionable insights to internal and external stakeholders.

Influence technical direction within your scope, mentor junior developers, and collaborate with cross-functional Google teams to support threat disruption efforts.

Qualifications

• Minimum qualifications:

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, a related technical field, or equivalent practical experience.

• 5 years of experience in threat intelligence, intrusion analysis, incident response, or a similar security role.

• Experience with threat intelligence platforms and tools (e.g., VirusTotal, SIEMs).

• Experience in analyzing and correlating data from various sources to track threat activity.

• Experience analyzing attacker tactics, techniques, and procedures (TTPs), particularly those used by financially motivated threat actors.

Preferred qualifications

• Experience and interest in mentoring junior team members.

• Proficiency in scripting or querying languages (e.g., Python, GoogleSQL).

• Ability to lead complex threat research projects.

• Excellent skills in malware analysis, reverse development, or incident response.