Security Engineer II, Uppercase Research

There's no such thing as a "safe system" - only safer systems. Our Security team works to create and maintain the safest operating environment for Google's users and developers. As a Security Engineer, you help protect network boundaries, keep computer systems and network devices hardened against attacks and provide security services to protect highly sensitive data like passwords and customer information. Security Engineers work directly with network equipment and actively monitor our systems for attacks and intrusions. You also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

You use your industry experience to own and drive the resolution of complex security incidents, policy questions and technical security issues.

Uppercase is a specialized team of security engineers dedicated to identifying and mitigating threat actors before they can achieve their mission. Originating from Alphabet's moonshot factory, X, and developed within Chronicle (now Google SecOps), we leverage expertise in big data, cybersecurity, machine learning, and large-scale cloud computing to engineer next-generation security solutions. In this role, you will partner with the broader security community to ensure the advantage remains with those fighting cybercrime.

Responsibilities

• Conduct technical threat actor behavior analysis and perform in-depth search into threat activity.
• Perform data analysis on large threat intel data sets to draw insights that feed new threat detection development or ML pipelines.
• Contribute to building and maintaining detection engineering processes and tooling as needed. Work with partner teams from around Google to discover new detection capabilities.
• Manage pipelines that write and improve YARA-L rules to track and identify potentially malicious behavior.
• Contribute to innovating detection engineering and rule lifecycle leveraging LLM-based technologies.

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.
• 1 year of experience with security assessments or security design reviews or threat modeling.
• 1 year of coding experience in one or more general purpose languages.
• 1 year of experience with security engineering, computer and network security and security protocols.

Preferred qualifications:

• Experience in security research, detection engineering, or adjacent work.
• Experience with signals development, threat hunting, and threat modeling on endpoint or cloud data sources.
• Experience using LLMs and agents to elevate and increase productivity in developing threat detections and security tools.
• Experience with a programming language (Golang or Python), preferably in the development of security tools.