Security Engineer, Access Security Team

The PRISM (Proactive Access Risk Intelligence and Security Mitigations) team is part of the Access Security Team organization. We proactively focus on uncovering broad risks across the access landscape, gathering and distilling access intelligence from internal systems to fortify security, and deploying comprehensive measures to ensure every angle of access is understood and protected, including enforcing security invariants to prevent future regressions. We are also building the next-generation taxonomy for qualifying access risk, prototyping end-to-end pipelines to uncover security risks associated with agentic identities, and architecting secure-by-default solutions scaled across the enterprise.

As a Security Engineer, you will be working on security research and risk mitigation systems, help scope security problems, and contribute to projects across product areas to transform how Google manages and eliminates internal access risk.

In this role, you will be at the forefront of redefining Google’s internal access landscape. You will not just respond to risks; you will be anticipating them by building the next-generation taxonomy of access risk and architecting 'secure-by-default' solutions that protect our most critical infrastructure. From modeling complex attack paths to securing the rise of agentic identities, you will lead high-impact projects that transform how Google proactively manages risk at an enterprise scale.The US base salary range for this full-time position is $123,000-$174,000 + bonus + equity + benefits. Our salary ranges are determined by role, level, and location. Within the range, individual pay is determined by work location and additional factors, including job-related skills, experience, and relevant education or training. Your recruiter can share more about the specific salary range for your preferred location during the hiring process.

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.
• 1 year of experience with security assessments or security design reviews or threat modeling.
• 1 year of coding experience in one or more general purpose languages.
• Experience with security engineering within the infrastructure security or security research space.

Preferred qualifications:

• Experience designing and implementing distributed security systems or automated remediation frameworks at scale.
• Experience in performing complex threat modeling for large-scale distributed systems and conducting attack path modeling and simulation to identify non-obvious lateral movement and indirect access risks.
• Knowledge of system hardening techniques across various layers (OS, network, and application) to enforce security invariants and reduce the attack surface of critical production services.
• Understanding of identity and access management (IAM), mandatory access control (MAC), principle of least privilege, and zero-trust architectures in production environments.