Minimum qualifications:- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or equivalent practical experience.
- 5 years of experience in security operations (SOC), incident response, threat hunting, IT compliance or equivalent.
- Experience with log analysis, data querying (SQL), or monitoring security controls.
Preferred qualifications:- Experience coordinating cross-functional security incidents.
- Familiarity with Google's data analysis infrastructure (e.g., Plx).
- Understanding of common security frameworks, access governance models, and the vulnerability management lifecycle.
- Proven ability to translate operational security findings into technical engineering requirements.
About the jobIn this role, you are the observability and feedback engine of the team. You will ensure our autonomous remediations and agentic workflows are operating securely and effectively.
You will design and monitor the automated flows of agentic tooling and manage the operational fallback tiers when AI workflows flag anomalies or cannot manage required strategies for gTech's Access ecosystem. Utilizing your deep security domain knowledge, you will conduct actor and account access analysis, develop strategies for least privliedge, perform complex log analysis (SQL/Plx), and triage incident alerts. Crucially, your ground-level intelligence will feed directly back into our engineering roadmap, converting identified gaps and opportunities into systemic, automated prevention controls.
Individual pay is determined by factors including job-related skills, experience, and relevant education or training.
US: $123000 - $176000 (USD) 15% bonus target equity benefits
Learn more about benefits at Google .
Responsibilities- Monitor manual/agentic/automated flows, triage edge cases, and manage operational fallbacks when agentic workflows require human escalation.
- Run day-to-day access operations, perform advanced log analysis (SQL/Plx), and triage access alerts.
- Monitor access alerts, audit permission mappings, and verify the efficacy of our automated provisioning tools.
- Act as triage lead for the gTech ecosystem, monitor incident queues, conduct initial analysis, and orchestrate with Detection and Response (D&R) teams.
