Minimum qualifications:

• Bachelor's degree in Computer Science, Data Science, Information Security, a related technical field, or equivalent practical experience.
• 8 years of experience in security engineering, CTI, or security data analysis, and software development in Python, Go, or C++.
• Experience in CTI, threat actor tracking, malware analysis, or threat hunting, and modeling and analyzing security datasets.

Preferred qualifications:

• Extensive experience working directly with or embedded alongside front-line threat intelligence and reverse engineering teams to operationalize adversary tradecraft into structured datasets and automated tooling.
• Experience building and scaling ground-truth evaluation datasets, trajectory grading pipelines, and agentic benchmarking frameworks.
• Experience analytically owning large-scale data layers, data quality pipelines, or evaluation/benchmarking frameworks for AI/ML systems, LLMs, or autonomous agents.
• Deep expertise in graph analytics, knowledge graphs, clustering, embeddings, and petabyte-scale data processing engines (e.g., BigQuery, Cloud Spanner, distributed data pipelines) applied to threat intelligence corpora.

About the job:

Security is at the core of Google's design and development process: it is built into the DNA of our products. The same is true of our offices. You're an expert who shares our seriousness about security and our commitment to confidentiality. You'll collaborate with our Facilities Management team to create innovative security strategies, investigate breaches and create risk assessment plans for the future. You believe that providing effective security doesn't come at the expense of customer service - you will be our bodyguard (and our long lost pal).Google Cloud accelerates every organization’s ability to digitally transform its business and industry. We deliver enterprise-grade solutions that leverage Google’s cutting-edge technology, and tools that help developers build more sustainably. Customers in more than 200 countries and territories turn to Google Cloud as their trusted partner to enable growth and solve their most critical business problems.Individual pay is determined by factors including job-related skills, experience, and relevant education or training.

Netherlands: €160000 - €164000 (EUR) + 20% bonus target + equity + benefits

Learn more about benefits at Google.

Responsibilities:

• Take end-to-end ownership of the GTI Agentic data layer, defining the technical strategy, architecture, and governance for curating and structuring multi-modal security datasets across Google Threat Intelligence.
• Design, architect, and build novel investigative tools, link-analysis frameworks, and data-mining pipelines to discover previously unseen relationships, campaign clusters, and threat actor patterns across massive internal and external security datasets.
• Own the quality, fidelity, taxonomy, and ground truth of our AI and autonomous agent evaluation frameworks (evals), ensuring benchmarks accurately reflect real-world malware reversing, threat hunting, deobfuscation, and CTI workflows.
• Act as the primary technical stakeholder and liaison for partner organizations, aligning roadmaps, co-designing agentic skills, and integrating front-line threat intelligence and reverse engineering workflows into the agentic platform.
• Solve complex, zero-to-one data engineering bottlenecks, such as distinguishing true agentic reasoning failures from dataset artifacts.