Minimum qualifications:

• Bachelor’s degree or equivalent practical experience.

• 6 years of experience in either system design or in one programming language (Java, C++, Python, etc.).

• 6 years of experience in technical troubleshooting, and managing internal/external partners or customers.

• Experience working with incident response investigations, analysis, and containment actions.

• Experience with network forensics, malware triage analysis, cloud forensics, and disk and memory forensics.

• Active US Government Top Secret/Sensitive Compartmentalized Information (TS/SCI) security clearance with polygraph.

Preferred qualifications:

• Experience in SIEM event analysis, triage, and investigation.

• Experience with security impact assessment and formal reporting.

• Knowledge of security event management, leveraging common support systems (e.g. ServiceNow) to document and manage the lifecycle of an incident.

• Knowledge of technical requirements development of SecStack tooling (e.g., SPULK, ElasticSearch, Google Secops/Chronicle + SCC, Trellix Endpoint Detection and Response-EDR, IDS/IPS, etc.).

• TIER 1/Tier 2 Analyst Support and Technical Mentorship.

In this role, you'll serve as a mentor to those starting their security careers while also advising executive leadership on the security posture of various platforms.

Drawing from Mandiant's legacy of excellence in incident response, you'll apply your diverse experience and perspective to address emerging security threats, empowered by the capabilities of Google.

Google Public Sector (https://about.google/intl/ALL_us/public-sector/#::text=We're%20committed%20to%20advancing,%2C%20research%2C%20and%20edtech%20companies.) brings the magic of Google to the mission of government and education with solutions purpose-built for enterprises. We focus on helping United States public sector institutions accelerate their digital transformations, and we continue to make significant investments and grow our team to meet the complex needs of local, state and federal government and educational institutions.

The US base salary range for this full-time position is $142,000-$211,000 + bonus + equity + benefits. Our salary ranges are determined by role, level, and location. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. Within the range, individual pay is determined by work location and additional factors, including job-related skills, experience, and relevant education or training. Your recruiter can share more about the specific salary range for your preferred location during the hiring process.

Please note that the compensation details listed in US role postings reflect the base salary only, and do not include bonus, equity, or benefits. Learn more about benefits at Google (https://careers.google.com/benefits/) .

• Utilize support systems (e.g., ServiceNow) to document and manage the entire incident life-cycle.

• Define technical requirements for essential security tools such as SIEMs, EDRs, and IDS/IPS (e.g., SPLUNK, ElasticSearch, Google SECOPS/Chronicle + SCC, Trellix Endpoint Detection and Response-EDR, IDS/IPS, etc.).

• Manage operational troubleshooting of security stack tooling, address technical issues with security tools to ensure optimal performance.

• Improve and refine incident response processes for greater efficiency.

• Create and maintain detailed playbooks for consistent and effective incident response.

Google is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. See also https://careers.google.com/eeo/ and https://careers.google.com/jobs/dist/legal/OFCCPEEOPost.pdf If you have a need that requires accommodation, please let us know by completing our Accommodations for Applicants form: https://goo.gl/forms/aBt6Pu71i1kzpLHe2.