Information Security Engineer, Hardware Security

Minimum qualifications:

• Bachelor's degree in Computer Science, Computer Engineering, Electrical Engineering, or a related field, or equivalent practical experience.

• 2 years of experience with offensive security research, with a focus on practical, real-world attacks.

• Experience in systems security, specifically finding and mitigating vulnerabilities at the intersection of hardware and software (e.g., Kernel, Hypervisor, Firmware).

Preferred qualifications:

• Experience building or using tools to discover, analyze, or reproduce hardware-level vulnerabilities.

• Understanding of Confidential Compute technologies (TEEs) and microarchitectural concepts, including speculative execution and side-channels.

• Track record of taking responsibility for technical outcomes in high-pressure security environments, such as vulnerability response or complex architectural reviews.

• History of public engagement, including published research, conference presentations, or contributions to open-source security projects.

• Ability to provide subject matter expertise to business stakeholders to help prioritize and remediate security risks based on technical impact analysis.

About the job:

Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for attacks and intrusions. In this role, you will also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

The industry relies on operating systems and hardware security boundaries that are not good enough. Some of these were historically believed to be secure and we have recently come to terms with what they are, and some we had no other choice at the time.

Our mission is to enable applications from Google and the world to have secure operating system and hardware privilege boundaries. We secure Google and the world by reviewing and strengthening the privilege boundaries that applications assume to be secure (e.g., virtualization layer, kernel seccomp layer, co-scheduling, process isolation). These boundaries are larger than Google so require a collaborative effort to secure.

Responsibilities:

• Help responses to microarchitectural vulnerabilities by assessing their impact at Google’s scale and coordinating remediation with internal teams and external vendors.

• Contribute to architectural reviews, and improvements for Confidential CPU, GPU, and TPU environments.

• Research and develop long-term, systematic mitigations—such as robust isolation primitives—to ensure that hardware vulnerabilities never pose a significant risk to the world again.

• Partner with internal product teams to design applications that are architecturally resilient to modern hardware threats from day one.

• Collaborate deeply with hardware vendors and research institutions to share knowledge, triage impacts, and inform the design of a more secure future.