The Google Cloud Professional Security Operations Engineer (PSOE) certification tests whether you can run detection and response on Google Security Operations, and its English exam is moving to a new 2.0 exam guide on 24 November. This guide sets out what Google Cloud publishes about the certification: who it is for, the two-hour exam, the six domains and how their weightings change between the current guide and version 2.0, recommended experience, a preparation plan built on Google's own learning path, the fee, the two-year validity and the renewal route through Google Skills. It is written for SOC analysts, detection engineers and incident responders working on Google SecOps, and for the managers planning their training. Exam facts were checked on Google Cloud's certification page, both exam guides and the certification help centre in November 2026; confirm details with Google Cloud before you register.
This is an independent guide from NHI Mgmt Group, based on Google Cloud's public certification documentation as of November 2026. It is not sponsored or reviewed by Google. Exam details change, so confirm them against Google Cloud's current documentation.
Key takeaways
- Two hours, 50 to 60 multiple-choice questions, $200. Online or at a Pearson VUE test centre, in English and Japanese, with no formal prerequisites.
- A new English exam from 24 November. Google says version 2.0 reflects updates to Google Security Operations, Security Command Center and Google Threat Intelligence; check which guide applies to your exam date.
- Detection engineering and data management carry the most weight in 2.0. Each is about 20%, with threat hunting and incident response about 18% each.
- Identity is examined directly. Configuring access for human and non-human identities, API access for automations and Workforce Identity Federation all sit in the platform operations domain.
- Valid for two years, renewable through learning. Google offers a renewal path of designated courses or skill badges completed in the final year of the certification.
Who the certification is for
Google's 2.0 exam guide describes the certified professional as someone who detects, monitors, investigates and responds to threats against workloads, endpoints, identities and infrastructure; writes detection rules; prioritises and ingests logs; builds orchestration and response automation; and applies posture data, threat intelligence and AI to detection and response. Google recommends three or more years of security industry experience, including at least one year using Google Cloud security tooling.
- SOC analysts moving up: people who triage alerts in Google SecOps and want to show they can also tune parsers, write rules and build playbooks. See the SOC Analyst Career Guide.
- Detection engineers: the detection engineering domain asks for YARA-L rules, composite detections, risk-based detections and coverage mapped to MITRE ATT&CK. The Detection Engineer Career Guide covers the role.
- Threat hunters and incident responders: hypothesis-led hunting, retrohunts, containment, root cause analysis and case management are all named objectives.
- SIEM migration teams: engineers moving log sources and content into Google SecOps benefit from the data management domain. The SIEM Migration Guide covers the programme side.
For an overview of the platform itself, read the Google Security Operations (Chronicle) Guide first; this page stays on the certification.
Exam format and domains
What Google Cloud publishes about the exam
| Item | What Google Cloud states | Source |
|---|---|---|
| Length | 2 hours | Certification page |
| Questions | 50 to 60 multiple choice | Certification page |
| Fee | $200 plus tax where applicable | Certification page |
| Languages | English, Japanese | Certification page |
| Delivery | Online proctored, or onsite at a Pearson VUE testing centre | Certification page |
| Prerequisites | None | Certification page |
| Recommended experience | 3+ years in security, including 1+ year with Google Cloud security tooling | Certification page |
| Validity | 2 years | Certification page |
| Exam rules | Not open book; no breaks; launch from 10 minutes before to 20 minutes after the scheduled time; legal name must match photo ID | Certification help centre |
| Changes | Reschedule or cancel more than 24 hours ahead without a late fee; each attempt in any language or delivery method counts toward permitted attempts, with a waiting period between attempts | Certification help centre |
The six domains: current guide and version 2.0
Google publishes two exam guides on the certification page: the current one, and version 2.0 for exams taken in English on or after 24 November. The domains are the same; the weightings and detail shift.
| Domain | Current guide | Version 2.0 | What 2.0 adds or emphasises |
|---|---|---|---|
| 1. Platform operations | ~14% | ~13% | SecOps Content Hub tools, AI and automation, UDM and stats searches, evaluating IOCs and TTPs; access for human and non-human identities |
| 2. Data management | ~14% | ~20% | A new objective on ingesting and configuring threat intelligence: loading IOCs into the Entity Context Graph and using Google Threat Intelligence features such as LiveHunt and URL scanning |
| 3. Threat hunting | ~19% | ~18% | Natural language prompting, security graphs and reviewing Triage and Investigation Agent results |
| 4. Detection engineering | ~22% | ~20% | YARA-L for low-prevalence indicators, Security Command Center threat detectors, AI infrastructure risks, ATT&CK coverage mapping, composite detections, AI-assisted rule creation |
| 5. Incident response | ~21% | ~18% | Responding to threat intelligence alerts, AI investigation tools, custom transformers and logical operators in playbooks, case SLAs and closure reasons |
| 6. Observability | ~10% | ~11% | Health alerts through Cloud Monitoring, diagnosis with Cloud Logging and Gemini Cloud Assist, silent source detection |
The practical message: if you sit in English on or after 24 November, study from the 2.0 guide, give threat intelligence ingestion its own time, and expect questions on the AI-assisted features Google now names in hunting, detection and response.
How the domains map to control frameworks
| Exam domain | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Platform operations (access) | PR.AA-05 | AC-6 Least Privilege |
| Data management | PR.PS-04; DE.AE-07 | AU-6 Audit Record Review, Analysis, and Reporting |
| Threat hunting | DE.AE-02; ID.RA-02 | RA-10 Threat Hunting |
| Detection engineering | DE.CM-01; DE.AE-02 | SI-4 System Monitoring |
| Incident response | RS.MA-01; RS.AN-03 | IR-4 Incident Handling |
| Observability | PR.PS-04 | SI-4 System Monitoring |
Prerequisites and experience
There are no formal prerequisites, so the recommendation of three years in security and a year on Google Cloud security tooling is the real guide to readiness. In practice, candidates do best when they have:
- Hands-on Google SecOps time: searching with UDM, reading and modifying parsers, writing YARA-L rules and running playbooks.
- Google Cloud identity basics: IAM roles, service accounts and Workforce Identity Federation, because objective 1.2 asks you to configure access for human and non-human identities and manage API access for automations. The Google Cloud IAM and Service Accounts Guide covers the foundations.
- Log source knowledge: which logs matter for which detections, including Google Cloud audit logs. See the Google Cloud Audit Logs and Log Sinks Guide.
- Incident response method: evidence collection, scoping, containment and root cause analysis, independent of tooling. The Incident Response Guide is the reference.
On exam day you need a government-issued photo ID whose name matches your registration (Romanised characters for Pearson scheduling), a clear work area and your session launched within the allowed window. Proctor check-in takes 5 to 15 minutes.
Preparation plan
Google links a learning path on Google Skills, a partner learning path and a set of sample questions from the certification page. Use them as the spine of an eight to twelve week plan.
- Confirm your exam guide (week 1): decide whether you will sit before or after 24 November and download the matching guide. Turn every objective into a line in a tracking sheet.
- Baseline with the sample questions (week 1): take them once cold to find your weakest domains.
- Work the learning path (weeks 2 to 5): complete the courses and labs, prioritising data management and detection engineering, which together carry about 40% of the 2.0 exam.
- Build in a lab tenant (weeks 4 to 8): ingest a log source, adjust a parser, create labels, write a single-event and a multi-event YARA-L rule, a composite detection and a playbook with enrichment and stakeholder notification. Never practise on production detections without change control.
- Hunt and respond (weeks 6 to 9): write a hunting hypothesis, run a retrohunt against historical logs, work a case through stages to closure and record SLA metrics.
- Observability (week 9): build a dashboard of alert and ingestion KPIs and configure silent source detection with a threshold alert.
- Review and book (weeks 10 to 12): retake the sample questions, fill gaps against the objective sheet, then book and test your online proctoring setup.
Measuring readiness
- Objective coverage: share of 2.0 objectives you have done hands-on, not just read about.
- Rule quality: detections you wrote that fire on test data and stay quiet on normal data.
- Hunt to detection rate: hunts you turned into a standing rule.
- Sample question confidence: correct answers you can justify from documentation.
Common failure patterns
- Studying the wrong guide: the weightings and objectives differ before and after 24 November.
- Treating it as an analyst exam only: a fifth of the 2.0 exam is data management, including parsers, normalisation, labels and cost.
- Skipping identity: access for non-human identities and API access for automations are explicit objectives.
- Ignoring observability: health monitoring and silent sources are about a tenth of the exam and easy to prepare for.
- Losing the session on admin: launching outside the window or a name mismatch forfeits the fee.
The skills translate straight into SOC metrics; the Security Operations Metrics Guide lists the measures that observability dashboards should carry.
Cost, renewal and continuing education
| Item | What Google Cloud states |
|---|---|
| Registration fee | $200 plus tax where applicable |
| Validity | 2 years |
| Renewal format | Designated courses and, or, skill badges in the renewal learning path on Google Skills |
| Renewal eligibility | Courses or badges completed within the last year of the certification's active period |
| Renewal validity | 1 year, as listed on the certification page |
| Account set-up | Link your CM Connect and Google Skills accounts with the same email |
| Rescheduling | Free more than 24 hours ahead; late fees within 24 hours |
Google's renewal route is learning-based, so keeping current with SecOps, Security Command Center and threat intelligence features also maintains the credential. If you hold credentials with CPE schemes, record this work there too; see the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
- From analyst to engineer: the PSOE recognises the move from working alerts to building the detections, pipelines and playbooks that create them.
- Alongside the Professional Cloud Security Engineer: Google's two professional security certifications cover different work. The Google Professional Cloud Security Engineer Guide focuses on securing Google Cloud configurations; the PSOE focuses on detecting and responding to threats. Teams running both prevention and operations on Google Cloud often hold both.
- Detection engineering track: pair it with tool-neutral practice in the Detection Engineering Guide and Threat Hunting Guide.
- Automation track: playbook objectives connect with the SOAR and Security Automation Guide.
Practitioner checklist
- Check your planned exam date against 24 November and download the matching exam guide.
- Take Google's sample questions once at the start and once at the end.
- Complete the 13 activities in the Google Skills learning path for the certification.
- Ingest a log source, modify a parser and add labels in a lab tenant.
- Write single-event, multi-event and composite YARA-L detections and map them to ATT&CK.
- Configure scoped IAM access for an automation service account and review its audit logs.
- Build a playbook with enrichment, containment and notification steps.
- Run a hypothesis-led hunt and a retrohunt, then close a case with stages and SLA metrics.
- Set up a health dashboard with silent source detection.
- Check your ID name, test your setup and diary the renewal window for year two.
Standards and references
- Google Cloud: Professional Security Operations Engineer certification
- Google Cloud: Professional Security Operations Engineer exam guide 2.0
- Google Cloud: Professional Security Operations Engineer exam guide (current)
- Google Skills: Professional Security Operations Engineer Certification learning path
- Google Cloud Certification Help: Exam policies
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev 5, Security and Privacy Controls
Related NHI Mgmt Group resources: Google Security Operations (Chronicle) Guide · Google Professional Cloud Security Engineer Guide · SOC Analyst Career Guide · Detection Engineer Career Guide · SIEM Guide