AI Security Engineer, Detection and Response

Accountabilities:

• Design, build, and deploy AI-powered agents and automation workflows to investigate and triage security alerts, enrich incidents, develop detection rules, and execute approved response actions.

• Develop and optimize automated security processes that streamline routine operations and allow security professionals to focus on complex threats and critical decisions.

• Conduct AI-driven threat hunting to identify emerging risks, uncover security gaps, and translate findings into new detection capabilities.

• Manage the full security incident response lifecycle, including detection, investigation, containment, eradication, recovery, and post-incident reviews.

• Perform digital forensics and security investigations across endpoint, cloud, identity, and SaaS environments.

• Write, implement, and continuously improve security detections using code-based detection engineering practices.

• Collaborate with engineering, IT, managed security operations partners, and leadership to coordinate incident response and strengthen security processes.

• Identify opportunities to improve security visibility, operational efficiency, and automation through AI-driven solutions.

• Contribute to the development of a scalable, proactive detection and response strategy that protects organizational systems, data, and users.

Requirements:

• At least 5 years of professional cybersecurity experience, primarily focused on security operations, detection engineering, and incident response.

• Proven experience leading security incident investigations, managing complex security events, and conducting digital forensics.

• Hands-on experience developing, implementing, and tuning detection rules within security monitoring and detection platforms.

• Demonstrated experience building or integrating end-to-end AI agents and LLM-based solutions for security operations, particularly alert triage, automated investigations, and incident response.

• Strong scripting and automation capabilities, particularly with Python.

• Practical experience working with cloud environments such as AWS, Azure, or Google Cloud Platform (GCP).

• Familiarity with infrastructure-as-code practices and automated deployment workflows.

• Ability to combine AI technologies with established cybersecurity methodologies while understanding the limitations and risks of automated security decisions.

• Strong analytical, investigative, and problem-solving skills, with the ability to manage immediate security incidents alongside longer-term engineering initiatives.

• Excellent organizational and prioritization skills, including the ability to remain calm and make sound decisions under pressure.

• Strong written and verbal communication skills, with the ability to explain complex technical concepts clearly to technical and non-technical stakeholders.