Google Cloud Cloud Security Engineer

Most cloud incidents trace back to access that was too broad. You choose roles carefully, add conditions, manage service accounts without long-lived keys, and give outside workloads access through federation.

• Basic, predefined and custom roles
• IAM conditions and deny policies
• Service account design and impersonation
• Avoiding service account keys
• Workload Identity Federation for outside systems
• Auditing and trimming excess permissions

You build A least-privilege IAM design for three teams with no service account keys.

Structure is a security control. You place resources in folders and projects that match your boundaries, and apply organization policies that stop unsafe choices before they happen.

• Hierarchy design for isolation
• Policy inheritance and exceptions
• Organization policy constraints that matter for security
• Tags and conditional policy
• Separating production from development
• Governing project creation

You build A hierarchy and organization policy set that blocks five risky configurations.

Traffic should be filtered close to where it enters and leaves. You configure Cloud NGFW policies, protect web applications with Cloud Armor, and control outbound internet access with Secure Web Proxy.

• Cloud NGFW policy design
• VPC firewall rules and hierarchical policies
• Cloud Armor security policies and rate limiting
• DDoS and bot protection
• Secure Web Proxy for egress control
• Testing and logging firewall decisions

You build A perimeter design with firewall policies, a Cloud Armor policy and controlled egress.

Flat networks let attackers move freely. You segment networks, connect VPCs and data centers privately, reach Google services without public addresses, and set data boundaries with VPC Service Controls.

• Network segmentation and VPC design for security
• Private Service Connect and Private Google Access
• Connecting VPCs and data centers privately
• VPC Service Controls perimeters
• Access levels and ingress and egress rules
• Troubleshooting perimeter violations

You build A segmented network with private access to Google APIs and a service perimeter around sensitive data.

You cannot protect data you have not found. You discover sensitive data in storage and analytics, classify it, and apply masking and tokenization so most users never see raw values.

• Sensitive data discovery with Sensitive Data Protection
• Classification and labeling
• De-identification: masking and tokenization
• Column and row protections in analytics
• Protecting data in logs and exports
• Handling data subject requests

You build A discovery and de-identification workflow for a dataset with personal data.

Encryption puts trust in keys. You decide who controls them, use Cloud KMS with customer-managed and external keys, protect secrets, and protect data in use with Confidential Computing.

• Default encryption and customer-managed keys
• Cloud KMS key rings, rotation and access
• External keys with EKM and HSM
• Secret Manager design
• Encryption in transit and certificate management
• Confidential Computing for data in use

You build A key management plan with CMEK, rotation and separated administration.

AI systems add new data flows and new attacks. You protect training data, models and pipelines, control who can call model endpoints, and screen prompts and responses with Model Armor.

• Threats to AI workloads
• Protecting training data and model artifacts
• Access control for Vertex AI resources
• Screening prompts and responses with Model Armor
• Network and perimeter controls for AI services
• Logging and monitoring AI usage

You build A security design for an AI workload covering data, models, endpoints and screening.

Security checks that run late find problems late. You scan code and images in the pipeline, enforce deployment policy with Binary Authorization, and protect the build system itself.

• Scanning code, dependencies and images in pipelines
• Binary Authorization attestations and policy
• Securing build service accounts and triggers
• Infrastructure policy checks before deploy
• Artifact integrity and provenance
• Responding to a compromised dependency

You build A pipeline with scanning gates and a deploy-time policy that rejects unattested images.

Detection depends on collecting the right evidence. You configure audit logs and sinks, use Security Command Center and Event Threat Detection, add network detection, and route findings to the people who act.

• Cloud Audit Logs: admin, data access and system events
• Log sinks and central log projects
• Security Command Center findings
• Event Threat Detection and Cloud IDS
• Alerting and routing findings
• Investigating an alert with logs

You build A central logging and detection setup with alerts for five attack scenarios.

Auditors want controls mapped to rules. You translate regulations into technical controls, apply Assured Workloads and data regionalization, and use the shared responsibility model to show where your duty ends.

• Mapping requirements to controls
• Shared responsibility in Google Cloud
• Assured Workloads and compliance regimes
• Data regionalization and residency
• Access Transparency and Access Approval
• Preparing and keeping audit evidence

You build A control map and evidence plan for one regulatory framework.

Secure one environment end to end. You set up identity, boundaries, data protection and detection, include an AI workload and a pipeline, then test your own controls and report what you find.

• Threat modeling the target environment
• Applying identity, network and data controls
• Securing an AI workload and a pipeline
• Detection and attack simulation
• Reporting findings and closing gaps

You build A secured environment with a tested detection setup and a findings report.