Google Workspace Breach Investigation

Over the past week I have seen unauthorized access attempts, unusual file-download spikes and an uptick in phishing emails inside our Google Workspace domain. I need a seasoned Workspace administrator to run a focused, end-to-end security investigation whose primary goal is detecting—and confirming the extent of—any data breach within Gmail and Google Drive.

You will receive admin-level access to the Admin console, audit logs and all existing security dashboards. From there I expect:

• A deep dive into Gmail and Google Drive audit trails, correlating timestamps, IP addresses and file-activity records to pinpoint breach timeline, entry vectors and affected users or documents.
• Clear documentation of every finding, backed by log excerpts or screenshots, delivered in a concise incident-response report.
• Immediate remediation steps where possible (session revocation, permission clean-up, password resets, phishing rule adjustments) or precise instructions for my internal team.
• A hardening plan covering ongoing monitoring, alert policies, DLP or S/MIME settings and any other best-practice controls that will reduce future risk.

I consider the job complete when the incident report is in my hands, recommended fixes are applied or queued, and I have a straightforward checklist to keep the domain secure moving forward.