Principal Incident Response Consultant, Google Public Sector

Job description

Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for attacks and intrusions. In this role, you will also work with software engineers to proactively identify and fix security flaws and vulnerabilities.

The Incident Response team within Google Public Sector drives cybersecurity resilience across the public sector, delivering proactive defensive transformations and rapidly deploying incident response to contain breaches, leveraging tangible Mandiant brand recognition value that continuously enriches GPS products and strengthens GPS’s credibility as the premier public sector experts for front line against sophisticated nation-state threats.

Google Public Sector brings the magic of Google to the mission of government and education with solutions purpose-built for enterprises. We focus on helping United States public sector institutions accelerate their digital transformations, and we continue to make significant investments and grow our team to meet the complex needs of local, state and federal government and educational institutions.

Responsibilities

• Conduct analysis and manage consulting engagements with a focus on incident response and forensics, serving as the subject matter expert and point person from kickoff through full remediation.
• Recommend and document specific countermeasures and mitigating controls while mentoring less experienced staff throughout the engagement lifecycle.
• Identify and develop new business opportunities, articulating the combined capabilities of Google and Mandiant in marketing discussions and capability briefings.
• Develop comprehensive reports and presentations for technical and executive audiences while improving business processes and incident response methodologies.

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.
  
• 8 years of experience managing enterprise incident response operations and threat containment.
• 3 years of experience scripting, working with code, or system design.
• Experience conducting host and network computer forensics to isolate root causes.
• Experience performing memory analysis to detect evasion techniques.

Preferred qualifications:

• Possession of industry-recognized cybersecurity certifications such as CISSP, CISM, or GIAC (e.g., GCFA, GCFE).
• Experience implementing enterprise security solutions, such as threat detection and hunting, malware intelligence, or Cloud Security Posture Management (CSPM).