Staff Information Security Engineer, Product Security

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.

• 8 years of experience with security assessments or security design reviews or threat modeling.

• 8 years of experience with security engineering, computer and network security and security protocols.

• 8 years of experience with coding in one or more general purpose languages.

• 3 years of experience leading teams in a technical capacity or leading technical risk analysis in an enterprise environment.

Preferred qualifications:

• Experience managing large-scale security improvements and collaborating with product teams to remediate widespread technical issues.

• Experience building or deploying automated tools (e.g., Large Language Model (LLM)-based agents) for security workflows such as triage automation or bug fixing.

• Strong background in software security, particularly in vulnerability research and reproduction, threat modeling and assessments, and variant analysis.

About the job:

Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for attacks and intrusions. In this role, you will also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

The Information Security Engineer (ISE) team mission is to make it easy for Google and the world to ship secure products. The Singapore-based team is focused on scaling our operations and risk reduction efforts through advanced automation and remediation. Our mission is to safeguard billions of users by efficiently triaging external security reports and proactively eliminating classes of vulnerabilities across Google's products and infrastructure. We aim to evolve into a self-sustaining, Artificial Intelligence (AI)-motivated operation that provides deep insights into vulnerability trends while fostering a community of security researchers.

In this role, you will lead a team of security engineers to scale our capacity to perform research, conduct analysis, derive risk insights and drive large-scale remediation projects across Google. You will also guide the development of AI agents to automate root cause analysis, variant analysis and trend analysis of vulnerabilities. You will be a technical leader, able to mentor, and guide other engineers, fostering a collaborative environment to achieve collective goals. You will have a technical foundation and exceptional cross-functional collaboration skills to manage complex security tests and operations. You will have a breadth of application security experience: web security, mobile security, Application Programming Interface (API) security, authentication and access control, threat modeling, conducting security assessments, etc.The Core team builds the technical foundation behind Google’s flagship products. We are owners and advocates for the underlying design elements, developer platforms, product components, and infrastructure at Google. These are the essential building blocks for excellent, safe, and coherent experiences for our users and drive the pace of innovation for every developer. We look across Google’s products to build central solutions, break down technical barriers and strengthen existing systems. As the Core team, we have a mandate and a unique opportunity to impact important technical decisions across the company. Responsibilities:

• Provide technical leadership and mentorship to teammates. Understand and advise others on complex processes and workflows related to product security response and remediation efforts.

• Foster global collaboration and maintain a high level of operational independence while collaborating with Global Leads in the United States (US) and Zurich to align on remediation efforts.

• Drive end-to-end development of Artificial Intelligence (AI) agents and infrastructure to automate root cause analysis, variant analysis, trend analysis, remediation to reduce manual workloads.

• Build and maintain a unified vulnerability analysis pipeline and dashboarding system to provide executive-level insights into emerging threats and program Return on Investment (ROI).

• Drive large-scale remediation efforts that eliminate entire classes of vulnerabilities across Google’s products and infrastructure.