Software engineer role in threat intelligence at Google Cloud

Build scalable collection tools, shape unstructured text with ML, and help secure systems at Google Cloud

The software engineer position described here is aimed at candidates who combine systems experience with an appetite for security-focused data engineering. You should have a foundation such as a Bachelor’s degree or equivalent practical experience, plus at least 5 years working on relevant engineering problems like software test engineering, consumer electronics, or internal tooling. Practical exposure to research areas such as artificial intelligence, machine learning, data mining, natural language processing, and image classification is valuable because the role blends collection with automated analysis.

We seek engineers who can move from prototype to production, taking ownership of systems that operate at scale. Experience parsing messy inputs—using tools from regex and heuristics to LLM integrations—is important when the goal is to turn chaotic web content into structured signals. Familiarity with spam detection, adversary analysis, and other threat intelligence techniques will accelerate your impact.

Who we are looking for

Minimum qualifications focus on demonstrable technical background. Candidates should bring a Bachelor’s degree or equivalent practical experience and a minimum of 5 years in engineering roles that emphasize testing, device software, or internal platform work. Prior research or hands-on work in AI, ML, NLP, data mining, or related domains is expected. These skills ensure you can contribute to both collection systems and the models that make sense of data.

Preferred skills and environments

Preferred candidates have built distributed systems at scale and are comfortable inside large production environments such as those used at Google. Knowledge of Spanner or similar horizontally distributed databases, plus an understanding of network security, threat intelligence, and operational approaches to handling sensitive feeds, will help you design resilient pipelines. Being able to evaluate and mitigate risk when working with dynamic data sources is a key asset.

What you will build

You will design, implement, and maintain high-throughput APIs and ingestion layers that move data through the threat intelligence stack. That entails engineering automated web collection and scraping tools that can monitor the dark web, deep web, and private messaging platforms reliably and at scale. Projects will include architecting end-to-end data pipelines that accept noisy, unstructured content and apply applied ML or LLM-based processing to normalize and shape it into actionable intelligence.

Production scale and collaboration

Beyond development, the role requires deploying, scaling, and operating highly available services inside a complex production environment. You will work with distributed databases and production tooling, ensuring services remain stable and performant. Collaboration with threat analysts, data scientists, and internal security teams is central: engineers translate raw collection capabilities into high-fidelity defensive tools that inform protection and response.

Operational security and data handling

The job also emphasizes correct handling of sensitive data sources. You will apply operational security practices to limit exposure and preserve integrity, balancing the need for comprehensive collection with privacy and safety concerns. Skills in parsing messy text—mixing regex, heuristics, and model-based approaches—are required to transform unstructured inputs into structured outputs that downstream systems and analysts can trust.

Location, policies, and how we hire

Applicant information submitted through Google Careers is processed according to company privacy policies. Google is an equal opportunity employer and is committed to building inclusive teams that reflect the users it serves. If you need an accommodation during the application process, you can complete the provided accommodation form so the recruiting team can assist. Note that for global collaboration, English proficiency is required for most roles unless explicitly stated otherwise in the posting.

Recruitment agencies should not forward candidates or resumes directly; Google does not accept unsolicited agency submissions and will not be responsible for related fees. The position offers a chance to work on challenging, meaningful problems where engineering, machine learning, and security intersect to protect customers and advance cloud infrastructure.

Scritto da Dr. Luca Ferretti

Smart home strategies to reduce pollen and control indoor air