Senior Security Developer, Google Threat Intelligence Group

Google seeks a Senior Security Developer in Zürich to lead threat intelligence research, analyze attacker TTPs, and drive disruption efforts for financially motivated actors.

The Security team at Google is dedicated to building and sustaining the most secure operating environment possible for its users and developers. This position focuses on deep-dive research into threat groups, their specific tactics, techniques, and procedures, as well as the malware they utilize. By contributing to these efforts, the role directly supports threat disruption initiatives and strengthens the overall security posture of the organization.

Responsibilities

• Manage and prioritize the monitoring of sophisticated, financially driven threat actors, including those involved in ransomware and extortion, while overseeing related research initiatives.
• Conduct advanced technical analyses to model threat activity, map out tactics, techniques, and procedures (TTPs), and identify indicators of compromise (IOCs) across internal systems.
• Develop and implement detection signatures to ensure continuous visibility into threat actor behaviors and help address security vulnerabilities.
• Generate high-quality technical intelligence reports and actor profiles that provide actionable insights to both internal teams and external partners.
• Guide the technical strategy within the assigned area, mentor less experienced developers, and partner with cross-functional groups to advance threat disruption goals.

Requirements

• A Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a closely related technical discipline, or equivalent hands-on experience.
• At least five years of professional experience in threat intelligence, intrusion analysis, incident response, or a comparable security function.
• Demonstrated familiarity with threat intelligence platforms and tools, such as VirusTotal and SIEMs.
• Proven ability to analyze and correlate data from multiple sources to track and understand threat activity.
• Experience in examining attacker tactics, techniques, and procedures, with a specific focus on those employed by financially motivated groups.

Nice to have

• A background or strong interest in mentoring junior team members.
• Proficiency in scripting or query languages, such as Python or GoogleSQL.
• The capability to lead complex threat research projects from start to finish.
• Strong skills in malware analysis, reverse development, or incident response.

About the company

Google operates with the belief that absolute security is unattainable; instead, the focus is on continuously building safer systems. This mindset drives the company’s approach to protecting its users and developers against evolving digital threats.

• The organization embraces the principle that there is no such thing as a 'safe system,' only progressively safer systems.