Security Engineer II role focused on Enterprise Detection Engineering for Google’s enterprise environments and users.

Partner with peers to plan and carry out threat models and define detection requirements for enterprise surfaces, with emphasis on high-risk areas such as Insider Exfiltration, Access Abuse, and Malicious Process Execution.
Support engineering efforts to design and implement detection logic for systems made up of multiple (2-3) interconnected components, aiming for thorough coverage across enterprise surfaces.
Evaluate security risk and justify detection approaches using threat intelligence and risk models; implement improvements to existing detections to lower false positives and improve detection fidelity.
Join post-exercise activities such as Red Team and Purple Team to identify detection gaps, document results, and help implement remediation detections.
Collaborate on incremental enhancements to detection engineering pipelines, testing frameworks, and automation tooling.

Bachelor’s degree or equivalent practical experience.
1 year of experience in security assessments, security design reviews, or threat modeling.
1 year of coding experience in one or more general-purpose languages.
Experience in security engineering, computer and network security, and security protocols.

Experience building tools or automating workflows to improve security operations.
Experience with query languages (e.g., SQL, Logica) and detection rule formats (e.g., Yara-L, YARA, Sigma).
Some on-job or in-classroom experience in detection engineering, security operations (SOC), threat hunting, or incident response.
Knowledge of building and tuning detections on enterprise surfaces such as macOS, Linux, and Google Workspace/SaaS.
Knowledge of AI and agentic systems and concepts.
Familiarity with the MITRE ATT&CK framework and threat modeling methodologies.

Security Engineer II, Enterprise Detection Engineering

Job Description