Definitely check out the documentary Hackers Wanted [1], which follows Adrian. I found it interesting how he was able to break into some of the "high-profile computer networks".
SSL certificates can now be updated in GAE using the gcloud command[1].
You could combine that with lego[2] to renew a Let's Encrypt SSL certificate via DNS Challenge to automate the process until native automation is implemented in GAE.
Data Loss Prevention (DLP) tools could be installed on the mail servers to scan every email and email attachment before they leave the corporate network or are delivered to ensure there are not any SSNs, credit card numbers, birthdays, etc. present.