What you will do

• Lead complex initiatives spanning diverse security services teams; resolve design tradeoffs and implement critical components using large language models (LLMs), agents, and retrieval pipelines.
• Define reusable architecture for agents, retrieval-augmented generation (RAG), and tool integrations;
  choose deterministic or model-driven approaches based on evidence, risk, and cost.
• Establish evaluation methods and release criteria across workflows, covering factual accuracy, reliability, false positives, and regressions against validated evidence.
• Design consistent controls for least-privilege access, sensitive data, prompt injection, output validation, and analyst approval of high-impact response actions.
• Lead SIEM, SOAR, XDR/EDR, threat intelligence, and case management integration design; address scale, API failures, and dependencies across services.
• Improve shared Python components, testing, CI/CD, observability, and rollback practices; lead design reviews and coach engineers on difficult implementation decisions.
• Own reliability and measurable outcomes across related workflows, using investigation quality, analyst time saved, success rates, latency, and cost to guide improvements.
• Shape priorities with Security Operations, Threat Research, Data Science, and DevOps; coordinate technical dependencies, resolve production issues, and document architecture and operating standards.

What you will bring

• 7+ years building production software, including 2+ years with LLMs, agents, or applied ML; 1+ year in or alongside a SOC or security team.
• Deep Python and API engineering skills; experience evaluating providers such as OpenAI or Anthropic and open-source models for production use.
• A record of leading architecture and delivery across multiple workflows or services, with reusable designs adopted by other engineers.
• Experience setting AI evaluation and release criteria, diagnosing systemic failure modes, and balancing quality, security, latency, and cost.
• Strong security operations knowledge and experience designing secure integrations, evidence handling, and appropriate analyst oversight for automated response.
• Experience designing and operating distributed or event-driven cloud services, including testing, CI/CD, observability, resilience, and production of incident resolution.
• Ability to turn ambiguous needs into technical plans, influence decisions across teams, and coach senior engineers while remaining hands-on.

A Plus If You Have:

• Experience with SQL, Sigma detection rules, or mapping detections to MITRE ATT&CK.
• Experience with vector databases, hybrid retrieval, model fine-tuning, or agent orchestration frameworks.
• Background in incident response, network traffic analysis, or Windows event log analysis.
• Experience with containerized or event-driven services, or open-source contributions in security or ML tooling.