Responsibilities

Embedded Security Engineering and Delivery

• Work hand-in-hand with customer security, engineering, platform, and infrastructure teams to deliver production-ready security outcomes.
• Serve as the technical lead for security engineering engagements from discovery and assessment through hardened deployment and optimization.
• Assess security posture, operational requirements, business objectives, and existing tooling; identify gaps and define pragmatic improvement roadmaps.
• Translate business, operational, compliance, and security requirements into secure architectures, implementation plans, and measurable outcomes.
• Own delivery outcomes, identify blockers early, and drive execution across customer, AHEAD, and partner teams.
• Lead architecture design sessions, threat modeling workshops, implementation reviews, and hands-on working sessions with customer technical and security leaders.
• Communicate security risk in business terms, translating threat exposure and operational gaps into clear, risk-adjusted recommendations.
• Act as a trusted advisor during onboarding, implementation, rollout, operational handoff, and continuous improvement.

Security Operations, Detection, and Response

• Design and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.
• Build and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.
• Partner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.
• Define, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.
• Translate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.
• Validate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort.
• Establish detection-as-code practices, including version control, peer review, documentation, testing, change management, and promotion across environments.
• Own SIEM and security-data management across, schema mapping, parsing, normalization, enrichment, routing, retention, access controls, and cost/performance optimization.
• Define telemetry requirements and data-quality controls; monitor ingestion health, freshness, completeness, duplication, parsing failures, and coverage across identity, endpoint, cloud, network, SaaS, application, and AI sources.
• Develop and operationalize playbooks and automated workflows for investigation, containment, enrichment, escalation, and response.
• Build security tooling and detection systems that improve signal quality, reduce analyst burden, and accelerate time to response.
• Support behavioral analytics, anomaly detection, correlation, risk scoring, and other security analytics use cases.
• Define and track practical measures of security improvement, including detection coverage, response efficiency, automation coverage, false-positive reduction, and risk reduction.
• Troubleshoot integration issues, deployment blockers, data-quality problems, and production incidents in partnership with security, cloud, platform, and infrastructure teams.

Secure AI and AI-Enabled Security Operations

• Apply AI and automation to security outcomes such as alert enrichment, triage support, investigation summarization, clustering, playbook selection, threat analysis, and analyst copilots.
• Help customers securely adopt LLM, RAG, and agentic capabilities within security operations and broader enterprise environments.
• Lead or support threat modeling for AI-enabled architectures, including LLM applications, multi-agent workflows, RAG systems, vector databases, model endpoints, inference APIs, data pipelines, and MLOps platforms.
• Identify, assess, and mitigate AI-specific risks such as prompt injection, data leakage, data poisoning, model abuse, insecure integrations, excessive permissions, tool misuse, model extraction, and AI supply-chain risk.
• Define practical AI security guardrails covering identity, least privilege, data protection, human oversight, auditability, validation, monitoring, and safe failure modes.
• Secure AI control planes, data flows, model integrations, inference services, and non-human identities across AWS, Azure, GCP, and hybrid environments.
• Support AI governance implementation using practical controls and operating models aligned to frameworks such as NIST AI RMF, applicable regulations, and customer risk requirements.
• Contribute to AI-specific detection content, incident taxonomies, playbooks, tabletop exercises, and response procedures.
• Ensure AI-enabled security solutions are explainable enough for analysts and stakeholders to validate, govern, and act on their outputs.

Cloud, Platform, and Automation Engineering

• Deploy secure, cloud-native architectures on at least one major cloud platform such as AWS, Azure, or GCP.
• Apply security engineering practices across identity and access management, network security, endpoint security, data protection, secrets management, containerized workloads, and cloud posture.
• Implement secure integrations using REST APIs, webhooks, event-driven workflows, message queues, infrastructure as code, and policy as code.
• Use Python, PowerShell, Bash, or similar tools to build automation, security utilities, integrations, and operational tooling.
• Use AI-assisted development tools where they improve delivery speed and quality while maintaining secure coding, testing, review, and change-management practices.
• Create reusable deployment patterns, templates, playbooks, reference architectures, and accelerators that scale across customer engagements.
• Design for resiliency, observability, performance, scalability, maintainability, and secure operations.
• Improve reliability through documentation, testing, monitoring, version control, and standardized engineering practices.

Cross-Functional Leadership and Practice Development

• Collaborate across Security Operations, Security Engineering, Detection Engineering, Cloud, Infrastructure, Data, Application, Platform, and customer teams.
• Lead technical workshops and communicate effectively with engineering leaders, security leaders, CISOs, and other executive stakeholders.
• Mentor engineers and contribute to AHEAD best practices for security engineering, customer delivery, AI security, and solution design.
• Provide field feedback to influence platform roadmaps, product direction, reusable patterns, and architectural standards.
• Define and publish reusable security patterns, playbooks, implementation guides, and accelerators that grow AHEAD's security practice.
• Support proposal development, solution shaping, technical scoping, and customer commercial conversations as needed.
• Influence outcomes without direct authority while maintaining a strong customer-service and execution mindset.

Required Qualifications

• 5+ years of experience in security engineering, security operations, detection and response, cloud security, platform security, solutions engineering, forward-deployed engineering, or related technical roles.
• Demonstrated depth in at least one cybersecurity discipline, such as application security, SecOps or detection engineering, cloud security, IAM, offensive security, or GRC.
• Hands-on experience implementing or operating modern SOC technologies such as SIEM, XDR, SOAR, case management, security analytics, or threat intelligence platforms.
• Experience owning end-to-end security delivery in a customer-embedded, production, consulting, managed-services, or implementation environment.
• Experience deploying or integrating cloud-native architectures on AWS, Azure, GCP, or another major cloud platform.
• Strong understanding of security operations, incident response, detection engineering, threat hunting, cloud security, identity security, endpoint security, and security automation.
• Experience with security telemetry, data integration, normalization, enrichment, event correlation, and analytics workflows.
• Experience developing and managing detections through their full lifecycle, including use-case definition, rule or query development, testing, tuning, deployment, validation, documentation, and retirement.
• Experience managing security data sources, including parsers, schema mapping, normalization, enrichment, routing, retention, access controls, and data-quality monitoring.
• Experience with scripting and automation using Python, PowerShell, Bash, or a similar language.
• Familiarity with APIs and integration patterns including REST, webhooks, event-driven workflows, and message queues.
• Demonstrated experience applying AI, machine learning, LLMs, or AI-assisted development to practical security use cases. Theoretical familiarity alone is not sufficient.
• Working knowledge of AI security risks and controls relevant to LLM, RAG, agentic, or AI-enabled security workflows.
• Ability to lead technical engagements, own outcomes, drive execution, and influence without direct authority.
• Proven ability to communicate technical security risk clearly to both technical and non-technical stakeholders.
• Strong problem-solving skills, structured analytical thinking, and the ability to operate effectively in ambiguous, fast-moving environments.

Technical Skills

• Security operations: SIEM, XDR, SOAR, incident response, detection engineering, threat intelligence, threat hunting, case management, and security analytics.
• Detection engineering: detection use-case development, rule and query languages, correlation logic, Sigma or platform-native content, MITRE ATT&CK mapping, detection-as-code, testing, tuning, and coverage validation.
• SIEM and security data management: parsing, schema mapping, normalization, enrichment, data-quality monitoring, ingestion health, routing, retention, access controls, and cost/performance optimization.
• Cloud and infrastructure security: AWS, Azure, GCP, IAM, network security, endpoint security, secrets management, container security, and cloud posture management.
• Security engineering: threat modeling, secure-by-design principles, vulnerability management, security controls, logging and monitoring, production hardening, and incident response.
• Automation and integration: Python, PowerShell, Bash, REST APIs, webhooks, event-driven architectures, message queues, CI/CD, infrastructure as code, and policy as code.
• AI security: LLM and agentic architectures, RAG, embeddings, vector databases, inference services, AI application security, prompt injection, data protection, guardrails, model and data supply-chain risks, and runtime monitoring.
• Security data and analytics platforms such as Kafka, Kinesis, Pub/Sub, Spark, Databricks, BigQuery, Snowflake, or similar technologies are a plus.

Preferred Qualifications

• Experience in an MSSP, MDR, XDR, managed security, consulting, or other security service delivery environment.
• Experience designing or improving SOC processes, detection coverage, response playbooks, or threat-hunting programs.
• Experience with detection-as-code, purple teaming, adversary emulation, automated detection validation, or detection content engineering at scale.
• Experience designing or optimizing SIEM data architectures, security telemetry pipelines, data onboarding standards, or security-data governance programs.
• Experience securing AI applications, LLM solutions, RAG systems, agentic workflows, or AI development and runtime environments.
• Experience deploying solutions in regulated, compliance-sensitive, or high-availability environments.
• Familiarity with OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, OWASP LLM Top 10, MITRE ATT&CK, NIST Cybersecurity Framework, NIST AI Risk Management Framework, or similar standards.
• Familiarity with Kubernetes, containers, DevSecOps, CNAPP, CSPM, cloud-native security tooling, or secure software delivery practices.
• Experience building reusable implementation frameworks, security engineering patterns, or field playbooks.
• Experience managing, developing, or coaching engineers is a plus.
• Relevant cloud, security, or platform certifications are a plus.

Education

• Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience