Description
Summary We are building an AI driven security operations platform that applies agentic AI to alert triage, investigation, and response for enterprise and managed security environments. Safety, reliability, and auditability are foundational design principles. This is a hybrid role, approximately 50 percent AI engineering and 50 percent security engineering. On the AI side, you will design, build, and evaluate the multi agent systems at the core of the platform. On the security side, you will provide the domain expertise that makes those agents effective through detection engineering, investigation methodology, and SOC workflow design. This is a production engineering role, not a research position. Full technical and product details will be shared under NDA during the interview process. What You Will Do AI and Security Engineering Develop multi agent LLM workflows for alert triage, enrichment, investigation, and response, including agent state management, tool routing, and inter agent handoffs. Build and maintain evaluation pipelines for agent quality, including golden datasets, regression testing, LLM as judge scoring, and human review workflows. Engineer prompts, structured outputs, and tool interfaces while optimizing the balance between model quality, latency, and cost. Instrument AI agents with observability tooling for tracing, token accounting, and failure analysis, then use those insights to continuously improve performance. Evaluate and integrate models from multiple providers, including open weight models for latency sensitive or privacy sensitive workloads. Translate SOC investigation methodology into agent behavior, including triage logic, pivot strategies, evidence standards, and escalation criteria. Implement AI safety controls such as untrusted evidence handling, read only defaults, approval gates, reasoning traces, and fail safe escalation. Build integrations with leading SIEM and EDR platforms, including detection as code pipelines and programmatic query interfaces. Author and convert detection content across major rule formats and query languages, integrating them into automated investigation workflows. Design and implement strong tenant isolation and secure data handling throughout the platform. What We’re Looking For Required Production experience building LLM applications using agent frameworks such as LangGraph or similar, prompt engineering, tool integration, structured outputs, and systematic evaluation. Five or more years of experience in security engineering, detection engineering, or SOC operations with hands on incident response experience. Strong Python development skills with production experience building modern asynchronous backend services. Working knowledge of MITRE ATT&CK and at least one major SIEM query language such as KQL, SPL, CQL, or equivalent. Strong understanding of LLM security risks, including prompt injection, data poisoning, and tool abuse, with practical experience designing secure AI systems. Candidates with deeper expertise in either AI engineering or security engineering will be considered if they demonstrate meaningful working proficiency in the other discipline. Pure ML researchers without security experience and SOC analysts without software engineering skills are not a fit. Preferred Experience with model evaluation frameworks, fine tuning, or local model deployment using Ollama, vLLM, or similar technologies. Experience building or operating multi tenant security platforms. Cloud native architecture experience on a major cloud provider. Familiarity with security data normalization standards such as OCSF. Experience with CI/CD pipelines for detection content and infrastructure as code. How We Work We value autonomy with accountability. AI agents operate with read only defaults and escalate when confidence is low. We expect engineers to apply the same judgment in system design and implementation. Decisions are documented, evidence driven, and clearly distinguish verified facts from assumptions. Tech Stack Python, modern asynchronous backend frameworks, LLM agent frameworks, LLM observability tools, PostgreSQL, Redis, TypeScript, major cloud platforms, and leading SIEM and security technologies.