Professional Security Operations Engineer: new exam with guide 2.0 on 24 November

It is Google Cloud's professional certification for people who run a SOC on Google tooling: you detect, monitor, analyze, investigate and respond to threats against workloads, endpoints, identities and infrastructure. You write detection rules, decide which logs to ingest and how, orchestrate the response and automate it. Guide 2.0 adds two words to that description compared with the previous one: identities and artificial intelligence.

There are no prerequisites, but Google recommends 3+ years of security industry experience, including at least 1 year with Google Cloud security tooling. If you come from another vendor's SIEM or SOAR, your analyst judgment carries over; what you need to learn is the product: UDM, YARA-L, the Entity Context Graph, SOAR playbooks and the SCC detectors.

The new version goes live in English on 24 November 2026. Until then, the exam follows the current guide. The exam is offered in English and Japanese; the 24 November date applies to the English version, and Google has not yet announced when the Japanese one switches.

The format does not change: 2 hours, 50 to 60 multiple choice questions and USD 200 plus applicable tax. You take it online with a remote proctor or at a test center. The certification is valid for 2 years and you renew it through Google Skills by completing the designated courses or skill badges in the renewal path during the last year of validity.

The six sections stay, with the same names. What changes is the split and, above all, the detail inside each one. The current guide assessed tasks in SecOps and SCC; guide 2.0 adds Google Threat Intelligence as a third platform, and GTI shows up in almost every section.

Data management grows the most, from 14% to 20%, and gets its own new subsection, 2.3 Configuring and Ingesting Threat Intelligence: ingesting GTI or third-party IOCs into the Entity Context Graph and using LiveHunt, Digital Threat Monitoring (DTM), Google Insights and URL Scanning. Ingestion also gets concrete: Bindplane to route Windows Event logs to SecOps and direct ingestion of SCC findings.

Platform operations now covers the SecOps Content Hub, UDM and stats searches, integrating GTI IOCs and TTPs, and authentication with Model Context Protocol (MCP). The access subsection is now about human and non-human identities. Threat hunting adds natural language prompting of AI, the SCC security graph and analyzing the results of the Triage and Investigation Agent.

Detection engineering drops to 20% but carries the most new tasks: SecOps data tables for risk values, Compliance Manager and AI infrastructure risks, Web Security Scanner, SCC detectors such as Cloud Run Threat Detection, Container Threat Detection and Virtual Machine Threat Detection, coverage analysis against MITRE ATT&CK, composite detections, AI-written rules and Applied Threat Intelligence with the Emerging Threats Center.

Incident response drops to 18% and adds responding to DTM alerts, investigating with the Triage and Investigation Agent and the Gemini Summary widget in SOAR, playbooks that update findings in SCC or invoke the agent, and custom transformers. Case management now focuses on lifecycle metrics: tagging, SLAs, stages and closure reasons. Observability rises to 11% and includes Gemini Cloud Assist plus reports from GTI and SCC.

If your exam is booked before 24 November and you have been preparing for weeks, keep the date: you are assessed on the current guide, which is what you studied. If you have not booked yet or need more than three more weeks of study, prepare guide 2.0 directly and book from the 24th. Studying the current guide now to sit the exam in December leaves you without GTI, without the AI agents and with a smaller Data management section than the one you will face.

What pays off most with guide 2.0: practice UDM searches and YARA-L rules, composite ones included; learn how data is ingested and enriched (parsers, aliasing, the Entity Context Graph); know GTI capabilities end to end, from LiveHunt to DTM; and understand what the Triage and Investigation Agent does and how a playbook invokes it. Also review the SCC detectors and when to use each one instead of a SecOps rule.

Google links its training path, the official sample questions and both guides from the exam page. On CertifyDeck you have Professional Security Operations Engineer questions written on guide 2.0, covering the six sections with their weights, with an explanation for every question and a timed mock exam. Start free.