Security Engineer II, Enterprise Detection Engineering

Cybersecurity Jobs; San Jose (CA); On-site; USD 123,000 - 174,000; Full time

Benefits offered by this job

Equity

Benefits

Job summary

Google is seeking a Security Engineer II to focus on Enterprise Detection Engineering for its enterprise environments and users.

You'll partner with peers to design threat models, define detection requirements, and implement detection logic across 2–3 interconnected components, aiming for thorough coverage. The role also involves evaluating risk with threat intelligence and joining Red Team and Purple Team activities to identify gaps and drive improvements to tooling and pipelines.

Qualifications

• Bachelor’s degree or equivalent practical experience.
• 1 year of security assessments, security design reviews, or threat modeling.
• 1 year of coding experience in a general-purpose language.
• Experience in security engineering, computer and network security, and security protocols.

Responsibilities

• Plan and carry out threat models and define detection requirements for enterprise surfaces.
• Support design and implementation of detection logic across 2–3 interconnected components.
• Evaluate risk using threat intelligence and risk models to reduce false positives.
• Participate in Red Team and Purple Team activities to identify detection gaps and remediation detections.
• Contribute to detection engineering pipelines, testing frameworks, and automation tooling.

Skills

Threat modeling

Security assessments

Security design reviews

Coding

Security engineering

Threat hunting

Education

Bachelor’s degree or equivalent

Tools

SQL

Logica

Yara-L

YARA

Sigma

MITRE ATT&CK

Job description

Security Engineer II role focused on Enterprise Detection Engineering for Google's enterprise environments and users.

Responsibilities

• Partner with peers to plan and carry out threat models and define detection requirements for enterprise surfaces, with emphasis on high-risk areas such as Insider Exfiltration, Access Abuse, and Malicious Process Execution.
• Support engineering efforts to design and implement detection logic for systems made up of multiple (2-3) interconnected components, aiming for thorough coverage across enterprise surfaces.
• Evaluate security risk and justify detection approaches using threat intelligence and risk models; implement improvements to existing detections to lower false positives and improve detection fidelity.
• Join post-exercise activities such as Red Team and Purple Team to identify detection gaps, document results, and help implement remediation detections.
• Collaborate on incremental enhancements to detection engineering pipelines, testing frameworks, and automation tooling.

Requirements

• Bachelor’s degree or equivalent practical experience.
• 1 year of experience in security assessments, security design reviews, or threat modeling.
• 1 year of coding experience in one or more general-purpose languages.
• Experience in security engineering, computer and network security, and security protocols.

Technologies

• SQL, Logica, Yara-L, YARA, Sigma
• MITRE ATT&CK
• macOS, Linux
• Google Workspace/SaaS, ChromeOS

Preferred Qualifications

• Experience building tools or automating workflows to improve security operations.
• Experience with query languages (e.g., SQL, Logica) and detection rule formats (e.g., Yara-L, YARA, Sigma).
• Some on-job or in-classroom experience in detection engineering, security operations (SOC), threat hunting, or incident response.
• Knowledge of building and tuning detections on enterprise surfaces such as macOS, Linux, and Google Workspace/SaaS.
• Knowledge of AI and agentic systems and concepts.
• Familiarity with the MITRE ATT&CK framework and threat modeling methodologies.

Location and Compensation

• Location: San Jose, CA (onsite)
• Salary: USD 123,000 - 174,000 per year
• Bonus target: 15%

Benefits

• Equity
• Benefits