Threat Intelligence Engineer, Cloud

Google Google · Big Tech · Málaga, Spain

This role focuses on engineering and scaling systems for threat intelligence within Google Cloud. It involves designing APIs for data ingestion, developing web scrapers for dark/deep web monitoring, and architecting data pipelines that use ML/LLMs to process unstructured web content into structured intelligence. The role also includes deploying and maintaining highly available services and collaborating with threat analysts and data scientists.

What you'd actually do

  1. Design, develop, and maintain high-throughput application programming interface (API) to facilitate data ingestion and extraction across the threat intelligence infrastructure.
  2. Engineer and optimize automated web collection tools and scrapers targeting the dark web, deep web, and messaging platforms to reliably monitor adversary communications.
  3. Architect data pipelines that ingest noisy, unstructured web content and use applied Machine Learning (ML) or Large Language Models (LLM) to parse, normalize, and shape it into structured intelligence.
  4. Deploy, scale, and maintain highly available services and pipelines within Google's production environment, and leverage distributed databases.
  5. Work closely with threat analysts, data scientists, and Google’s internal security teams to turn raw collection capabilities into high-fidelity defensive tools.

Skills

Required

  • Software test engineering
  • Consumer electronics
  • Internal tool development
  • Research in AI, distributed systems, ML, data mining, NLP, image classification, spam fighting or related fields
  • Building distributed systems
  • Working within Google production environments
  • Spanner
  • Network security
  • Threat intelligence
  • Operational security
  • Parsing and making sense of messy, unstructured text
  • Regex
  • Heuristics
  • LLM integrations

Nice to have

  • Understanding of network security, threat intelligence, and operational security when dealing with sensitive or dynamic data sources.

What the JD emphasized

  • applied Machine Learning (ML) or Large Language Models (LLM)
  • parse, normalize, and shape it into structured intelligence
  • automated web collection tools and scrapers targeting the dark web, deep web, and messaging platforms
  • Experience in research with artificial intelligence (AI), distributed systems, machine learning (ML), data mining, natural language processing (NLP), image classification, spam fighting or related fields.

Other signals

  • ML/LLM for parsing and normalization
  • Automated web collection for threat intelligence
  • High-throughput API for data ingestion/extraction
  • Deploying and scaling services in production