It depends on what the VM is going to do. Does this machine really receive external files that are going to be kept on the VM? If so, you might need an antivirus installed in the VM.
If this VM has your own software, your security could be the firewalls, Security Command Centre and Shielded VM's. If your VM is serving web apps you could look for Google's security tools like Cloud Armor.
As Cloud SQL instances are a managed service Google is responsible for the security at OS and DB software levels. Although data access security is the customer's responsibility.