Skip to main content
Ace Skills Consulting
Google Cloud logoAdvanced

PCSE: Google Professional Cloud Security Engineer

Design and run secure Google Cloud environments — identity, perimeters, data protection and detection — prepared for the PCSE exam.

  • 24 hours of live, security-focused training
  • Labs on IAM, VPC Service Controls and Cloud KMS
  • Security Command Center and logging in practice
  • Covers all Professional Cloud Security Engineer exam sections
  • Scenario practice with detailed explanations
Aligned to Google Cloud exam PCSE
Duration
3 Days | 24 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
PCSE
Language
English

Why learn PCSE with Ace Skills

  • Layered Google Cloud security

    Combine identity, network, data and operational controls into one coherent design.

  • Perimeters that work

    Learn to design VPC Service Controls without breaking legitimate access.

  • Detect and respond

    Practise triaging Security Command Center findings and investigating with audit logs.

  • Professional security credential

    Prepare for a certification recognised for cloud security engineering roles.

Course overview

Securing Google Cloud means getting many layers right at once: who can access what, how networks are segmented, how data is encrypted and classified, and how threats are detected and handled. This three-day course gives security professionals a structured, hands-on route through those layers using the controls Google Cloud provides.

Day one covers configuring access: Cloud Identity, single sign-on, the resource hierarchy, IAM roles, conditions and deny policies, service accounts and workload identity federation, plus organisation policies as guardrails. Day two focuses on securing communications and establishing boundary protection — VPC design, firewall policies, Cloud Armor, Identity-Aware Proxy, Private Service Connect and VPC Service Controls — followed by data protection with Cloud KMS, customer-managed and external keys, Secret Manager and Sensitive Data Protection.

Day three covers managing operations and supporting compliance: Security Command Center, audit and access logs, log sinks to a central project, incident response, secure CI/CD and container security with Binary Authorization and Artifact Analysis. We also discuss compliance frameworks, data residency through Assured Workloads and evidence collection for audits.

Labs build a secure landing zone step by step and end with an investigation exercise using Security Command Center findings. This course is aligned to the Professional Cloud Security Engineer exam and prepares you for it; confirm the current exam guide on the Google Cloud certification site before booking.

Key features

  • Secure landing zone built across the labs
  • IAM conditions, deny policies and workload identity
  • VPC Service Controls perimeter design
  • Key management with Cloud KMS and CMEK
  • Threat detection with Security Command Center
  • Scenario-based practice questions
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • Cloud security engineers and architects
  • Security operations professionals working with Google Cloud
  • Cloud engineers taking on security responsibilities
  • Compliance and governance specialists with technical backgrounds

Prerequisites

  • Associate Cloud Engineer or equivalent Google Cloud experience
  • Security fundamentals: identity, encryption and network security
  • Comfort with the gcloud CLI

Curriculum

3 Days · 24 Hours · 9 Modules · 6 Labs

  1. Identity foundations

    • Cloud Identity and Google Cloud Directory Sync
    • Single sign-on with third-party identity providers
    • Super administrator protection
    • Groups-based access management

    IAM in depth

    • Predefined and custom roles
    • IAM conditions and deny policies
    • Service accounts, impersonation and short-lived credentials
    • Workload identity federation
    • Lab: Replace service account keys with impersonation and workload identity · 50 min

    Guardrails

    • Organisation policy constraints
    • Resource hierarchy design for security
    • Policy Intelligence and IAM recommender
    • Lab: Apply organisation policies and review IAM recommendations · 35 min

  2. Network security

    • Hierarchical and network firewall policies
    • Cloud Armor and WAF rules
    • Identity-Aware Proxy
    • Private Google Access and Private Service Connect
    • Lab: Protect an application with Cloud Armor and IAP · 45 min

    VPC Service Controls

    • Service perimeters and bridges
    • Access levels with Access Context Manager
    • Dry-run mode and troubleshooting
    • Lab: Create a perimeter around BigQuery and Cloud Storage · 45 min

    Data protection

    • Cloud KMS, CMEK and Cloud HSM
    • External key management
    • Secret Manager
    • Sensitive Data Protection inspection and de-identification
    • Lab: Encrypt a bucket with CMEK and rotate the key · 30 min

  3. Security operations

    • Security Command Center findings and posture
    • Cloud Audit Logs and access transparency
    • Centralised log sinks
    • Incident response on Google Cloud
    • Lab: Investigate a suspicious finding with Security Command Center and audit logs · 50 min

    Secure delivery and workloads

    • Binary Authorization
    • Artifact Analysis and vulnerability scanning
    • GKE security hardening
    • Shielded and Confidential VMs

    Compliance and exam readiness

    • Assured Workloads and data residency
    • Mapping controls to frameworks
    • Timed practice set with review
Download full syllabus (PDF)

Skills you will gain

  • Cloud IAM
  • Workload identity federation
  • Organisation policies
  • VPC Service Controls
  • Cloud Armor
  • Identity-Aware Proxy
  • Cloud KMS
  • Sensitive Data Protection
  • Security Command Center
  • Cloud Audit Logs
  • Binary Authorization
  • Compliance

Tools & technologies

  • Google Cloud console
  • gcloud CLI
  • Security Command Center
  • Cloud Logging
  • Cloud KMS
  • Terraform

Certification exam

Exam details
Exam nameGoogle Cloud Certified – Professional Cloud Security Engineer
Exam codePCSE
Number of questions50–60
Duration120 minutes
Voucher includedNo — book directly with the vendor
Question formatMultiple choice, Multiple response
DeliveryOnline proctored or Test centre

Skill areas measured

  1. Configuring access within a cloud solution environment
  2. Securing communications and establishing boundary protection
  3. Ensuring data protection
  4. Managing operations
  5. Supporting compliance requirements

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 24 hours of live, trainer-led sessions
  • 6 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 1 · 50 min

    Replace service account keys with impersonation and workload identity

  • Day 2 · 45 min

    Create a perimeter around BigQuery and Cloud Storage

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The Google Cloud certification itself is awarded by Google Cloud when you pass exam PCSE.

Frequently asked questions

Do I need a security certification first?

No, but you should understand security fundamentals. Security+ or equivalent knowledge is a useful foundation.

Is this course useful for AWS or Azure security engineers?

Yes. We map Google Cloud controls to familiar equivalents and focus on what is distinctive, such as VPC Service Controls.

How much hands-on work is there?

Each day includes labs that together build a secure landing zone and end with an investigation exercise.

How should I prepare after the course?

Repeat the labs, review the documentation for IAM, VPC Service Controls and KMS, and practise scenario questions.

Can you run a private batch for our security team?

Yes. We can align scenarios with your organisation’s Google Cloud policies and tooling.

Related courses

Explore more

All Google Cloud courses Google Cloud certifications

Google Cloud is a trademark of Google LLC.

Train your team on PCSE

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.