Check which ladder you applied to before you plan prep, because it shapes the coding round. The general SWE loop is in the Google interview guide, and other companies’ security loops are in the security engineer interview guides.
What Google says about its hiring process
Google’s How we hire page is generic. You “may be asked to take the Google Hiring Assessment”, a workstyle test, and “role-related assessments, like a coding exercise, if applicable”. Then come “one or two shorter conversations over phone or video” with a recruiter and “a panel of interviews, either over video or in person”, scored on shared rubrics, with “no brainteasers”. Google puts the process at “roughly 6-8 weeks” and warns the decision alone can take “several weeks”.
Two other rules matter. “AI tools are not permitted to be used during your interviews.” And the interview tips page says “We’ve reintroduced in-person interviews for some roles. In many cases, you’ll complete initial interviews virtually before coming onsite.” The Security Engineer II and Staff posts we read on 4 November 2026 say “In most instances, this position requires in-person interviews as part of the hiring process.” The DeepMind red team, Mandiant and risk-and-compliance posts don’t.
Why the two security ladders post different coding bars
Security Engineer posts ask for security assessment experience plus general-purpose coding. Software Engineer, Security, Privacy, Detection requires “1 year of experience with data structures or algorithms”, the SWE bar, and Software Engineer III, Information Security lists them as preferred.
For the Security Engineer ladder, the evidence for a lighter bar is real but old. In an April 2022 Blind thread, a Google commenter put it at “LC easy or scripting tier”. In another 2022 thread, a Googler said it “shouldn’t be leetcode” but you should know data structures. A January 2026 Glassdoor review describes a “Two Sum”-style coding question.
Not everyone agrees. A Dropbox-tagged candidate who sat about nine interviews in a 2022 Detection and Response and EIP loop said at least three rounds each mixed in a coding question, then wrote “Half the interview is coding.” We can’t tell whether that means half of each interview or of the whole loop.
Our read: plan for easy-to-medium problems, often wrapped around a security task. The gracenolan/Notes repo, the best-known prep resource for the role, says “the number one reason why a candidate misses out on an offer is because they struggle with the coding questions.”
On the SWE ladder, prep for both. A Google-tagged reply in the second 2022 thread said “You probably still get at least one security round with open ended questions for SWE security loops too.” In a Reddit thread captured in January 2026, a recruiter told a SWE (Security) candidate in Poland the first 45-minute round would cover data structures and algorithms plus the security and privacy domain. One reply, describing a Google dev interview, put the questions at “leetcode medium and hard, leaning on hard”.
A careers search for “Information Security Engineer” returned no live posts. The one live title using the name is Software Engineer III, Information Security, but the 2022 “ISE” accounts on Blind were Security Engineer loops in the Information Security Engineering org.
The security teams Google is hiring for now
Security Engineer titles carry a team suffix, and the team shapes the domain questions. On 4 November 2026, detection had Enterprise Detection Engineering, Digital Forensics and a Zürich Staff role in NextGen Detection and Response. Identity and enterprise had Enterprise Access Security, Enterprise SaaS Security and Third Party Security Diligence. AI and research had AI Protection and Security Research. Offensive work appears as “GenAI Senior Security Engineer, Red Team”, “Senior Security Engineer, Agentic Red Team, DeepMind” and Mandiant’s Offensive Security Consultant.
The Early-tagged Security Engineer II access-security post even lists prompt injection, over-privileged access and data exfiltration, covered in our AI security interview questions.
What candidates report about the rounds and questions, 2019 to 2022
Of what we could read, only three Glassdoor reviews and one thin Blind thread on the Security Engineer role date from 2025 or 2026. The rest is older, and some is a Googler’s forecast.
In 2022 a Google commenter said the ISE phone screen “will be a 1hr round”, about 40 minutes of domain knowledge and 15 to 20 of coding. A 2022 candidate for a Security Engineer, Google Cloud role was told to expect one coding question by phone, then four virtual onsites. For the onsite, one Google commenter expected “Probably 3 domain knowledge/coding rounds”, a role-related knowledge round and a Googleyness round. The April 2022 commenter expected one or two mixed rounds plus role-related knowledge, Googleyness and “maybe security design rounds if you’re L5+”.
Domain and coding generally share a slot. Questions reported in 2022 threads and a 2024 reply include:
- What happens when you load google.com?
- What’s the difference between encoding, encryption and hashing?
- A host is running ransomware, or a crypto-miner. Walk me through your response.
- Walk through the TLS handshake. How do you prove you own a domain with a DNS TXT record?
- Review this Python login function for security bugs.
- How would you get into a CEO’s email?
For the code review questions, work through the secure code review interview. The CEO-mailbox prompt is a small threat modeling interview problem: scope, assets, attacker path.
The self-rating form Google commenters described in 2019 and 2022
Google-tagged Blind commenters in 2019 and 2022 described a self-rating questionnaire, scored out of 5, that steers the domain questions. In 2022 one said your interviewer “should hopefully choose something based on your strengths in the intake questionnaire”, and that if you put a 5 on a topic and your interviewer is also a domain expert, you’ll be grilled. The 2019 advice: “don’t claim you’re a 4/5 in crypto when you’ve never heard of AES.” Rate a topic high only where you can go three layers down, as in TLS, certificate validation, then CA misissuance. The sources don’t say when the form arrives, or whether it survives in 2026.
What the gracenolan/Notes GitHub repo covers
“Security Engineering at Google: My Interview Study Notes” is the most-cited prep resource. A Google security engineer published it in 2019 from notes she took while studying for the interviews for her first security job; its last commit was in February 2026. It’s a topic map, not a question bank: networking, web, cloud, OS internals, mitigations, crypto and identity, malware and exploits, threat modeling, detection, forensics, incident management and coding.
Its coding list is deliberately basic (loops, dictionaries, string handling, regex, quicksort, binary search, Big O), and its practice tasks are security text processing: a log parser, port-scan detection, a password bruteforcer, a YARA-style scanner. Its tips say questions are “intentionally vague” to draw out clarifying questions, and that re-interviewing is “completely normal and acceptable”.
Posted US pay by Security Engineer title
Each range is US-only and excludes bonus and equity.
| Google Security Engineer job title (source: Google Careers job posts, Nov 2026) | Google Careers level tag | Minimum years of security experience asked | Posted US-only pay range, excluding bonus and equity | Posted bonus target |
|---|---|---|---|---|
| Security Engineer II | Early | 1 | $123,000 to $174,000 | 15% |
| Security Engineer | Mid | 2 | $147,000 to $210,000 | 15% |
| Senior Security Engineer | Mid | 5 | $174,000 to $252,000 | 15% |
| Staff Security Engineer | Advanced | 8 | $207,000 to $300,000 | 20% |
No post gives an L-number. Convention reads Security Engineer II as L3 and Staff as L6, which is probably what people mean by the “Google L3 security engineer interview process”, but no Google page confirms the mapping. If the convention holds, equity matters most at Staff: Levels.fyi lists L6 total pay at $483,500, from only 10 submissions across all levels, well above the top of the posted Staff range plus bonus.
What to prep, in order of payoff
Start with the post. Enterprise Detection names SQL and Logica, YARA-L, Sigma and MITRE ATT&CK, so write rules and practise querying logs in SQL. Enterprise SaaS Security names SAML, SCIM and OIDC, so be able to draw an OIDC flow and say where a SAML assertion can be forged. Staff posts add their own asks: 3 years leading teams or technical risk analysis (Security Research), Kubernetes and open-source contributions (Seattle), and distributed systems (Zürich Detection and Response).
Next, script daily. Parse a log, count failed logins per IP, flag a port scan, and say the complexity aloud (the Big-O cheat sheet has the vocabulary). Add a few LeetCode easy and medium problems, since the one 2026 report went there. Our guess, not Google’s: practise a few without an IDE in case the in-person round has none.
Then drill fundamentals out loud: TLS, DNS, HTTP, encoding versus hashing. Run one threat model and one code review under a timer. At L5 and above, add a security system design interview, on the strength of one Google commenter’s “maybe”. Last, behavioral. Google’s hiring pages describe STAR answers and the formula “Accomplished [X], as measured by [Y], by doing [Z]”, never “Googleyness”, though 2022 Blind commenters still named that round (our Googleyness and GCA cheat sheet covers it). At Staff, pick stories that show the leadership the posts ask for; the STAR answer builder helps.
How to become a security engineer at Google
The posted minimum for Security Engineer II is 1 year of experience with “security assessments or security design reviews or threat modeling” plus 1 year of coding, and a bachelor’s degree or equivalent practical experience. Whether internships count toward that year is unconfirmed, and we found no live security internship posts on 4 November 2026. Google’s Cybersecurity Certificate targets analyst and SOC jobs; Google doesn’t pitch it for these roles. To compare with the labs, see the Anthropic security engineer interview and the OpenAI security engineer interview.
What we couldn’t confirm
- An official round count, the domain and coding split, whether a design round exists, or anything L3-specific.
- Whether “Googleyness” and a hiring committee are still named stages. Our most recent evidence for both is Blind posts from 2019 to 2022.
- Reddit threads on the Security Engineer role itself.
- Glassdoor beyond page 1 (36 ratings, 28 interviews), and any LeetCode Discuss posts on this role; we found none.
- Whether the Hiring Assessment applies to security roles, how team matching works now, and whether the in-person rule covers every loop.
- Interview Kickstart’s claims of five to six onsite rounds and an SWE-level algorithms bar.
The most current source is one you’ll get yourself. In 2022 the Google Cloud candidate’s recruiter, describing the role as “appsec/cr/threat model for a google product”, sent a prep list: networking, OS security, crypto and authentication, malware and exploits, log analysis, simple algorithms and basic data structures. Ask your recruiter for this year’s version; it will be newer than anything cited here.
Practice the behavioral round:
