Security Engineer, Red Team

Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for attacks and intrusions. In this role, you will also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

As Google's products and infrastructure operate at a massive scale, we need to anticipate and counter sophisticated adversaries targeting Google and our users. Within Google's Red Team, our team combines offensive security tradecraft with software and AI systems engineering to scale how Google conducts red teaming.

In this role, you will build and operate offensive security capabilities, adversary tooling, and AI-assisted red-teaming systems, while also planning and executing targeted offensive security efforts to benefit Google's security posture. You will turn real-world attack chains and Tactics, Techniques, and Procedures (TTPs) into reliable, reusable offensive tooling, working closely with defenders and engineering teams to test detection coverage and deliver defense-in-depth improvements.

The Core team builds the technical foundation behind Google’s flagship products. We are owners and advocates for the underlying design elements, developer platforms, product components, and infrastructure at Google. These are the essential building blocks for excellent, safe, and coherent experiences for our users and drive the pace of innovation for every developer. We look across Google’s products to build central solutions, break down technical barriers and strengthen existing systems. As the Core team, we have a mandate and a unique opportunity to impact important technical decisions across the company.

Responsibilities

• Design, build, and maintain offensive security capabilities, Command and Control (C2) tooling, and automated/agent-driven attack modules in Python and Go to test Google's infrastructure at scale.

• Plan and execute realistic, scenario-based offensive security exercises and Red Team operations against Google's production, corporate, cloud, and AI systems in strict compliance with Rules of Engagement.

• Convert proven real-world attack paths and adversary TTPs into safe, reliable, and reusable offensive modules and automation.

• Partner closely with Detection and Response (Blue Teams) and affected product and infrastructure teams to test monitoring and defense mechanisms, verify detection coverage, and drive defense-in-depth engineering improvements.

• Perform technical security assessments, code audits, and vulnerability research, and document and present findings to audiences ranging from technical engineers to executive leadership.

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.

• 2 years of experience with security assessments or security design reviews or threat modeling.

• 2 years of experience with security engineering, computer and network security and security protocols.

• 2 years of coding experience in one or more general purpose languages.

• Experience in offensive security, such as red teaming, penetration testing, vulnerability assessments, or offensive security tooling development.

Preferred qualifications:

• Master's degree in Computer Science or a related technical field, or an extensive professional track record in offensive security and red teaming.

• Experience building custom offensive security tools, Command and Control (C2) infrastructure, or AI-assisted security automation.

• In-depth knowledge of cloud environments, distributed systems, authentication protocols, or AI/ML system security.

• Familiarity with Detection and Response (Blue Team) concepts and conducting adversary simulations safely in production environments.

• Being able to clearly and concisely articulate complex technical findings, risks, and remediation strategies to both technical and non-technical audiences, both verbally and in writing.