I had a total of 6 interviews and lunch with a hiring manager.
Most of the interview questions are scenario-based (if x,y,z then what can you do/conclude) pertaining to fundamental infosec/incident response knowledge.
The interviewers take copious notes about what you say/write throughout your interview.
The first interview was a phone interview. The interviewer was really firm on sticking to the allotted time. In the middle of the interview, we lost audio. The final question was a coding question. After the "solving" the question, a constraint was added where I had to revise/add code. (This is why you should ask questions before diving into code, as well as explain to the interviewer what you plan to do prior to writing any code).
The day following the phone interview, the recruiter advised me that I would move invited onsite for additional interviews. Google covered the flight/lodging/car rental expenses.
I had a total of 5 on-site interviews, in addition to lunch with the hiring manager.
// Pause
The interviewers were all security engineers, but from various teams - since when you get hired as a security engineer you are expected to have knowledge of most things in that career ladder (not just what is pertinent to the specific vacancy you are interviewing for).
// Resume
At least 3 out of the 5 on-site interviews went well, I felt. A couple of the others, I was unsure about. But, I throughout the interviews, I was typically able to draw upon my experiences to answer the scenario-based questions. I also made sure to ask if I answered their questions sufficiently, since they want to know how "deep" you can go and gauge how you think.
One of the interviewers arrived late, and seemed to not be good at formulating/asking questions. This interviewer seemed to get a little agitated when I asked clarifying questions (which the recruiter had advised me to do).
Approximately a week after the on-site interviews, I learned that I made it past the hiring committee and was asked to provide references, current salary information, etc to my recruiter so that they could prepare a "packet" to be reviewed by executive management. I believe this stage was called "final approval".
A little over a week after learning I passed the hiring committee ( =a little over 2 weeks after on-site interviews), I learned I was approved for an offer. The recruiter and I spoke the next day to discuss the details of the offer (before I had the offer in hand), and later that same day I received an email with a link to the offer package.
The total process from submitting the application to receiving an offer was about 60 days. Keep in mind, during this time, Google held their I/O conference.