Director, Security Defense Platforms

Google•San Francisco, CA

8d•$307,000 - $427,000

About The Position

As the Director of Security Defense Platforms, you will lead the global software engineering organization responsible for the foundational software, streaming pipelines, telemetry architectures, and AI-driven automated containment infrastructure that powers Alphabet’s detection and response operations. You will serve as an executive engineering leader, building large-scale distributed data systems, driving high-reliability platform engineering, and advancing security automation and agentic defense. You will partner with Detection and Response domain leads and enterprise platform teams to move Google’s security posture from reactive detection and response toward proactive inference and interruption. You will manage, grow, and mentor a globally distributed organization of Software Engineering Managers, Tech Leads, and Software Engineers across multiple sites, and own the long-term architectural roadmap for Detection and Response core infrastructure. You will lead engineering and deployment of automated threat containment, including automated mitigation pipelines and dynamic endpoint mitigation, to disrupt high-risk access abuse, workspace DLP, and intrusion attempts in real time. You will drive integration of AI models and agentic reasoning into operational workflows such as alert triage, incident summaries, and investigations. You will also ensure platform reliability, multi-region resilience, and SLO compliance while reducing operational toil and on-call burden. The Core team builds the technical foundation behind Google’s flagship products, including underlying design elements, developer platforms, product components, and infrastructure. The team creates central solutions, breaks down technical barriers, strengthens existing systems, and influences important technical decisions across the company.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent practical experience.
15 years of software engineering and technical leadership experience, including 6 years managing managers and leading multi-site engineering organizations.
Experience partnering with security operations, threat intelligence, or incident response teams to build developer and detection platforms.
Experience using modern AI/ML applications in cybersecurity, including automated reasoning, LLM-based agent evaluation, anomaly detection, and synthetic threat injection or watermarking.

Nice To Haves

20 years of experience in software engineering, distributed systems, or enterprise platform infrastructure, with experience in cybersecurity or threat defense domains.
Experience architecting Security Orchestration, Automation, and Response (SOAR), SIEM, EDR data fabrics, or real-time event correlation engines.
Experience designing, building, and operating distributed streaming pipelines, query engines, and high-throughput data processing systems at enterprise or hyperscale.
Cross-functional leadership and executive presence to translate architectural challenges into clear business and security risk decisions for VP/SVP stakeholders.
Expertise in infrastructure cost optimization, data lifecycle and retention governance, and high-availability streaming SLO management.

Responsibilities

Lead the global software engineering organization responsible for foundational software, streaming pipelines, telemetry architectures, and AI-driven automated containment infrastructure for detection and response operations.
Manage, grow, and mentor a globally distributed organization of Software Engineering Managers, Tech Leads, and Software Engineers across multiple global sites.
Own the long-term architectural roadmap for Detection and Response core infrastructure.
Lead the engineering and deployment of automated threat containment, including automated mitigation pipelines and dynamic endpoint mitigation, to disrupt high-risk access abuse, workspace DLP, and intrusion attempts in real time.
Drive integration of AI models and agentic reasoning into operational workflows, automating alert triage, incident summaries, and investigative workflows.
Ensure platform reliability, multi-region resilience, and SLO compliance while reducing operational toil and on-call burden.
Foster a high-performance engineering culture emphasizing technical aptitude, operational excellence, and continuous architectural innovation.
Deliver large-scale resource optimization initiatives that reduce global data storage and compute footprints while maintaining strict end-to-end detection latencies.
Institutionalize configuration-based detection frameworks to accelerate authoring and productionization cycles.
Advocate for novel defense mechanisms for autonomous third-party agent security, data leakage mitigation, and federated access auditing.
Deliver against executive- and board-level cybersecurity risk-reduction commitments.