Security Technical Lead - AI SOC

The Security Technical Lead - AI SOC is a production security engineer who works embedded with customer security and engineering teams to make security operations more effective, measurable, and resilient. This role owns outcomes across assessment, design, build, deployment, optimization, and operational handoff.

The primary profile is a security engineer with meaningful AI experience. You should understand how security controls operate in production, how telemetry becomes detection and response, and how to reduce risk across complex enterprise environments. You will use AI and automation to strengthen those outcomes: improving detection quality, accelerating investigations, automating response, and helping customers securely govern and operate AI systems.

This is not a theoretical AI research role or a compliance-only position. It is a hands-on engineering role requiring the ability to design, build, integrate, troubleshoot, and operate security solutions in real customer environments. AI-assisted development tools such as Claude Code, Cursor, GitHub Copilot, or similar tools may be part of your standard delivery practice for building security tooling, detection content, automation, and governance capabilities.

Responsibilities

Embedded Security Engineering and Delivery

• Work hand-in-hand with customer security, engineering, platform, and infrastructure teams to deliver production-ready security outcomes.
• Serve as the technical lead for security engineering engagements from discovery and assessment through hardened deployment and optimization.
• Assess security posture, operational requirements, business objectives, and existing tooling; identify gaps and define pragmatic improvement roadmaps.
• Translate business, operational, compliance, and security requirements into secure architectures, implementation plans, and measurable outcomes.
• Own delivery outcomes, identify blockers early, and drive execution across customer, AHEAD, and partner teams.
• Lead architecture design sessions, threat modeling workshops, implementation reviews, and hands-on working sessions with customer technical and security leaders.
• Communicate security risk in business terms, translating threat exposure and operational gaps into clear, risk-adjusted recommendations.
• Act as a trusted advisor during onboarding, implementation, rollout, operational handoff, and continuous improvement.

Security Operations, Detection, and Response

• Design and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.
• Build and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.
• Partner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.
• Define, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.
• Translate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.
• Validate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort.
• Establish detection-as-code practices, including version control, peer review, documentation, testing, change management, and promotion across environments.
• Own SIEM and security-data management across, schema mapping, parsing, normalization, enrichment, routing, retention, access controls, and cost/performance optimization.
• Define telemetry requirements and data-quality controls; monitor ingestion health, freshness, completeness, duplication, parsing failures, and coverage across identity, endpoint, cloud, network, SaaS, application, and AI sources.
• Develop and operationalize playbooks and automated workflows for investigation, containment, enrichment, escalation, and response.
• Build security tooling and detection systems that improve signal quality, reduce analyst burden, and accelerate time to response.
• Support behavioral analytics, anomaly detection, correlation, risk scoring, and other security analytics use cases.
• Define and track practical measures of security improvement, including detection coverage, response efficiency, automation coverage, false-positive reduction, and risk reduction.
• Troubleshoot integration issues, deployment blockers, data-quality problems, and production incidents in partnership with security, cloud, platform, and infrastructure teams.

Secure AI and AI-Enabled Security Operations

• Apply AI and automation to security outcomes such as alert enrichment, triage support, investigation summarization, clustering, playbook selection, threat analysis, and analyst copilots.
• Help customers securely adopt LLM, RAG, and agentic capabilities within security operations and broader enterprise environments.
• Lead or support threat modeling for AI-enabled architectures, including LLM applications, multi-agent workflows, RAG systems, vector databases, model endpoints, inference APIs, data pipelines, and MLOps platforms.
• Identify, assess, and mitigate AI-specific risks such as prompt injection, data leakage, data poisoning, model abuse, insecure integrations, excessive permissions, tool misuse, model extraction, and AI supply-chain risk.
• Define practical AI security guardrails covering identity, least privilege, data protection, human oversight, auditability, validation, monitoring, and safe failure modes.
• Secure AI control planes, data flows, model integrations, inference services, and non-human identities across AWS, Azure, GCP, and hybrid environments.
• Support AI governance implementation using practical controls and operating models aligned to frameworks such as NIST AI RMF, applicable regulations, and customer risk requirements.
• Contribute to AI-specific detection content, incident taxonomies, playbooks, tabletop exercises, and response procedures.
• Ensure AI-enabled security solutions are explainable enough for analysts and stakeholders to validate, govern, and act on their outputs.

Cloud, Platform, and Automation Engineering

• Deploy secure, cloud-native architectures on at least one major cloud platform such as AWS, Azure, or GCP.
• Apply security engineering practices across identity and access management, network security, endpoint security, data protection, secrets management, containerized workloads, and cloud posture.
• Implement secure integrations using REST APIs, webhooks, event-driven workflows, message queues, infrastructure as code, and policy as code.
• Use Python, PowerShell, Bash, or similar tools to build automation, security utilities, integrations, and operational tooling.
• Use AI-assisted development tools where they improve delivery speed and quality while maintaining secure coding, testing, review, and change-management practices.
• Create reusable deployment patterns, templates, playbooks, reference architectures, and accelerators that scale across customer engagements.
• Design for resiliency, observability, performance, scalability, maintainability, and secure operations.
• Improve reliability through documentation, testing, monitoring, version control, and standardized engineering practices.

Cross-Functional Leadership and Practice Development

• Collaborate across Security Operations, Security Engineering, Detection Engineering, Cloud, Infrastructure, Data, Application, Platform, and customer teams.
• Lead technical workshops and communicate effectively with engineering leaders, security leaders, CISOs, and other executive stakeholders.
• Mentor engineers and contribute to AHEAD best practices for security engineering, customer delivery, AI security, and solution design.
• Provide field feedback to influence platform roadmaps, product direction, reusable patterns, and architectural standards.
• Define and publish reusable security patterns, playbooks, implementation guides, and accelerators that grow AHEAD's security practice.
• Support proposal development, solution shaping, technical scoping, and customer commercial conversations as needed.
• Influence outcomes without direct authority while maintaining a strong customer-service and execution mindset.

Required Qualifications

• 5+ years of experience in security engineering, security operations, detection and response, cloud security, platform security, solutions engineering, forward-deployed engineering, or related technical roles.
• Demonstrated depth in at least one cybersecurity discipline, such as application security, SecOps or detection engineering, cloud security, IAM, offensive security, or GRC.
• Hands-on experience implementing or operating modern SOC technologies such as SIEM, XDR, SOAR, case management, security analytics, or threat intelligence platforms.
• Experience owning end-to-end security delivery in a customer-embedded, production, consulting, managed-services, or implementation environment.
• Experience deploying or integrating cloud-native architectures on AWS, Azure, GCP, or another major cloud platform.
• Strong understanding of security operations, incident response, detection engineering, threat hunting, cloud security, identity security, endpoint security, and security automation.
• Experience with security telemetry, data integration, normalization, enrichment, event correlation, and analytics workflows.
• Experience developing and managing detections through their full lifecycle, including use-case definition, rule or query development, testing, tuning, deployment, validation, documentation, and retirement.
• Experience managing security data sources, including parsers, schema mapping, normalization, enrichment, routing, retention, access controls, and data-quality monitoring.
• Experience with scripting and automation using Python, PowerShell, Bash, or a similar language.
• Familiarity with APIs and integration patterns including REST, webhooks, event-driven workflows, and message queues.
• Demonstrated experience applying AI, machine learning, LLMs, or AI-assisted development to practical security use cases. Theoretical familiarity alone is not sufficient.
• Working knowledge of AI security risks and controls relevant to LLM, RAG, agentic, or AI-enabled security workflows.
• Ability to lead technical engagements, own outcomes, drive execution, and influence without direct authority.
• Proven ability to communicate technical security risk clearly to both technical and non-technical stakeholders.
• Strong problem-solving skills, structured analytical thinking, and the ability to operate effectively in ambiguous, fast-moving environments.

Technical Skills

• Security operations: SIEM, XDR, SOAR, incident response, detection engineering, threat intelligence, threat hunting, case management, and security analytics.
• Detection engineering: detection use-case development, rule and query languages, correlation logic, Sigma or platform-native content, MITRE ATT&CK mapping, detection-as-code, testing, tuning, and coverage validation.
• SIEM and security data management: parsing, schema mapping, normalization, enrichment, data-quality monitoring, ingestion health, routing, retention, access controls, and cost/performance optimization.
• Cloud and infrastructure security: AWS, Azure, GCP, IAM, network security, endpoint security, secrets management, container security, and cloud posture management.
• Security engineering: threat modeling, secure-by-design principles, vulnerability management, security controls, logging and monitoring, production hardening, and incident response.
• Automation and integration: Python, PowerShell, Bash, REST APIs, webhooks, event-driven architectures, message queues, CI/CD, infrastructure as code, and policy as code.
• AI security: LLM and agentic architectures, RAG, embeddings, vector databases, inference services, AI application security, prompt injection, data protection, guardrails, model and data supply-chain risks, and runtime monitoring.
• Security data and analytics platforms such as Kafka, Kinesis, Pub/Sub, Spark, Databricks, BigQuery, Snowflake, or similar technologies are a plus.

Preferred Qualifications

• Experience in an MSSP, MDR, XDR, managed security, consulting, or other security service delivery environment.
• Experience designing or improving SOC processes, detection coverage, response playbooks, or threat-hunting programs.
• Experience with detection-as-code, purple teaming, adversary emulation, automated detection validation, or detection content engineering at scale.
• Experience designing or optimizing SIEM data architectures, security telemetry pipelines, data onboarding standards, or security-data governance programs.
• Experience securing AI applications, LLM solutions, RAG systems, agentic workflows, or AI development and runtime environments.
• Experience deploying solutions in regulated, compliance-sensitive, or high-availability environments.
• Familiarity with OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, OWASP LLM Top 10, MITRE ATT&CK, NIST Cybersecurity Framework, NIST AI Risk Management Framework, or similar standards.
• Familiarity with Kubernetes, containers, DevSecOps, CNAPP, CSPM, cloud-native security tooling, or secure software delivery practices.
• Experience building reusable implementation frameworks, security engineering patterns, or field playbooks.
• Experience managing, developing, or coaching engineers is a plus.
• Relevant cloud, security, or platform certifications are a plus.

Education

• Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience