Threat Intelligence Security Engineer Lead

Google; Zürich; On-site; CHF 150,000 - 190,000; Full time

Job summary

Google is seeking a cybersecurity professional in our Mandiant unit to lead threat analysis and intelligence for Google and users. You will partner with product and security teams, analyze actor TTPs, and build automation to improve detection and response.

Part of Google Cloud, Mandiant brings frontline experience and world‑class threat intelligence to safeguard complex systems and data. Remote and on‑site collaboration may be required for rapid assessments.

Qualifications

• Minimum: Bachelor's degree or equivalent practical experience, plus 5 years in security assessments or threat modeling.
• Requires 5 years in security engineering, network security and security protocols.
• 5 years of coding experience in one or more general purpose languages.
• 1 year leading teams in a technical capacity or risk analysis in an enterprise.

Responsibilities

• Identify, analyze, and document network signals, malware behaviors, and threat reports.
• Provide actionable intelligence to product and security teams and safeguard systems.
• Own analysis of multiple threat actors and SME on potential impact to Google and users.
• Develop automation and proof-of-concept code; collaborate to deploy solutions.
• Prioritize tasks and work on assignments with limited supervision while meeting deadlines.

Skills

Security assessments

Threat modeling

Security design reviews

Security engineering

Network security

Security protocols

Coding

Team leadership

Education

Bachelor's degree or equivalent practical experience

Tools

YARA

Snort/Suricata

EDR rules

Job description

Google is seeking a cybersecurity professional in our Mandiant unit to lead threat analysis and intelligence for Google and users. You will partner with product and security teams, analyze actor TTPs, and build automation to improve detection and response.

Part of Google Cloud, Mandiant brings frontline experience and world‑class threat intelligence to safeguard complex systems and data. Remote and on‑site collaboration may be required for rapid assessments.