Security Engineer, Access Security Team

Minimum qualifications: Bachelor's degree or equivalent practical experience. 1 year of experience with security assessments or security design reviews or threat modeling. 1 year of coding experience in one or more general purpose languages. Experience with security engineering within the infrastructure security or security research space. Preferred qualifications: Experience designing and implementing distributed security systems or automated remediation frameworks at scale. Experience in performing complex threat modeling for large-scale distributed systems and conducting attack path modeling and simulation to identify non-obvious lateral movement and indirect access risks. Knowledge of system hardening techniques across various layers (OS, network, and application) to enforce security invariants and reduce the attack surface of critical production services. Understanding of identity and access management (IAM), mandatory access control (MAC), principle of least privilege, and zero-trust architectures in production environments. About the job The PRISM (Proactive Access Risk Intelligence and Security Mitigations) team is part of the Access Security Team organization. We proactively focus on uncovering broad risks across the access landscape, gathering and distilling access intelligence from internal systems to fortify security, and deploying comprehensive measures to ensure every angle of access is understood and protected, including enforcing security invariants to prevent future regressions. We are also building the next-generation taxonomy for qualifying access risk, prototyping end-to-end pipelines to uncover security risks associated with agentic identities, and architecting secure-by-default solutions scaled across the enterprise. As a Security Engineer, you will be working on security research and risk mitigation systems, help scope security problems, and contribute to projects across product areas to transform how Google manages and eliminates internal access risk. In this role, you will be at the forefront of redefining Google’s internal access landscape. You will not just respond to risks; you will be anticipating them by building the next-generation taxonomy of access risk and architecting 'secure-by-default' solutions that protect our most critical infrastructure. From modeling complex attack paths to securing the rise of agentic identities, you will lead high-impact projects that transform how Google proactively manages risk at an enterprise scale. Individual pay is determined by factors including job-related skills, experience, and relevant education or training. US: $123000 - $175000 (USD) + 15% bonus target + equity + benefits Learn more about benefits at Google. Responsibilities Drive the strategy for PRISM’s core pillars by identifying emerging access risks and designing technical solutions to mitigate them at scale. Architect and evolve security risk mitigation systems to enable continuous, automated assessment and remediation across Google’s infrastructure. Serve as a technical consultant for complex security challenges, guiding teams across Product Areas (PAs) to implement robust security invariants. Contribute to and lead technical execution for the Internal Access Control program suite.