{"id":104767,"url":"https://alion.io/job/ahead-forward-deployed-engineer-ai-soc","title":"Security Technical Lead - AI SOC","company":{"id":3614,"name":"AHEAD","domain":"ahead.com","url":"https://alion.io/company/ahead","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":74,"open_postings":53,"ghost_share":0,"stale_share":0.83,"repost_share":0,"time_to_fill_p50_days":71,"computed_at":"2026-10-20T05:45:00Z"}},"role":"AI/ML","role_family":"AI/ML","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":160000,"max":200000,"currency":"USD","period":"year","gross":null,"usd_annual":200000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon Kinesis","optional":false},{"name":"Anomaly Detection","optional":false},{"name":"Apache Kafka","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"BigQuery","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude Code","optional":false},{"name":"Copilot","optional":false},{"name":"Cursor","optional":false},{"name":"Databricks","optional":false},{"name":"Embeddings","optional":false},{"name":"GCP","optional":false},{"name":"Google BigQuery","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Machine Learning","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Multi-Agent Systems","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Snowflake","optional":false},{"name":"Spark","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Agentic Workflows","optional":true},{"name":"Kubernetes","optional":true},{"name":"OWASP","optional":true},{"name":"OWASP ASVS","optional":true},{"name":"OWASP Top 10","optional":true}],"status":"live","first_seen_at":"2026-07-14T17:20:56Z","employer_posted_date":"2026-07-14","last_verified_at":"2026-10-20T08:24:45Z","board_verified":true,"closed_at":null,"days_open":97,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":97},"description":"The Security Technical Lead - AI SOC is a production security engineer who works embedded with customer security and engineering teams to make security operations more effective, measurable, and resilient. This role owns outcomes across assessment, design, build, deployment, optimization, and operational handoff.\nThe primary profile is a security engineer with meaningful AI experience. You should understand how security controls operate in production, how telemetry becomes detection and response, and how to reduce risk across complex enterprise environments. You will use AI and automation to strengthen those outcomes: improving detection quality, accelerating investigations, automating response, and helping customers securely govern and operate AI systems.\nThis is not a theoretical AI research role or a compliance-only position. It is a hands-on engineering role requiring the ability to design, build, integrate, troubleshoot, and operate security solutions in real customer environments. AI-assisted development tools such as Claude Code, Cursor, GitHub Copilot, or similar tools may be part of your standard delivery practice for building security tooling, detection content, automation, and governance capabilities.\nResponsibilities\nEmbedded Security Engineering and Delivery\nWork hand-in-hand with customer security, engineering, platform, and infrastructure teams to deliver production-ready security outcomes.\nServe as the technical lead for security engineering engagements from discovery and assessment through hardened deployment and optimization.\nAssess security posture, operational requirements, business objectives, and existing tooling; identify gaps and define pragmatic improvement roadmaps.\nTranslate business, operational, compliance, and security requirements into secure architectures, implementation plans, and measurable outcomes.\nOwn delivery outcomes, identify blockers early, and drive execution across customer, AHEAD, and partner teams.\nLead architecture design sessions, threat modeling workshops, implementation reviews, and hands-on working sessions with customer technical and security leaders.\nCommunicate security risk in business terms, translating threat exposure and operational gaps into clear, risk-adjusted recommendations.\nAct as a trusted advisor during onboarding, implementation, rollout, operational handoff, and continuous improvement.\nSecurity Operations, Detection, and Response\nDesign and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.\nBuild and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.\nPartner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.\nDefine, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.\nTranslate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.\nValidate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort.\nEstablish detection-as-code practices, including version control, peer review, documentation, testing, change management, and promotion across environments.\nOwn SIEM and security-data management across, schema mapping, parsing, normalization, enrichment, routing, retention, access controls, and cost/performance optimization.\nDefine telemetry requirements and data-quality controls; monitor ingestion health, freshness, completeness, duplication, parsing failures, and coverage across identity, endpoint, cloud, network, SaaS, application, and AI sources.\nDevelop and operationalize playbooks and automated workflows for investigation, containment, enrichment, escalation, and response.\nBuild security tooling and detection systems that improve signal quality, reduce analyst burden, and accelerate time to response.\nSupport behavioral analytics, anomaly detection, correlation, risk scoring, and other security analytics use cases.\nDefine and track practical measures of security improvement, including detection coverage, response efficiency, automation coverage, false-positive reduction, and risk reduction.\nTroubleshoot integration issues, deployment blockers, data-quality problems, and production incidents in partnership with security, cloud, platform, and infrastructure teams.\nSecure AI and AI-Enabled Security Operations\nApply AI and automation to security outcomes such as alert enrichment, triage support, investigation summarization, clustering, playbook selection, threat analysis, and analyst copilots.\nHelp customers securely adopt LLM, RAG, and agentic capabilities within security operations and broader enterprise environments.\nLead or support threat modeling for AI-enabled architectures, including LLM applications, multi-agent workflows, RAG systems, vector databases, model endpoints, inference APIs, data pipelines, and MLOps platforms.\nIdentify, assess, and mitigate AI-specific risks such as prompt injection, data leakage, data poisoning, model abuse, insecure integrations, excessive permissions, tool misuse, model extraction, and AI supply-chain risk.\nDefine practical AI security guardrails covering identity, least privilege, data protection, human oversight, auditability, validation, monitoring, and safe failure modes.\nSecure AI control planes, data flows, model integrations, inference services, and non-human identities across AWS, Azure, GCP, and hybrid environments.\nSupport AI governance implementation using practical controls and operating models aligned to frameworks such as NIST AI RMF, applicable regulations, and customer risk requirements.\nContribute to AI-specific detection content, incident taxonomies, playbooks, tabletop exercises, and response procedures.\nEnsure AI-enabled security solutions are explainable enough for analysts and stakeholders to validate, govern, and act on their outputs.\nCloud, Platform, and Automation Engineering\nDeploy secure, cloud-native architectures on at least one major cloud platform such as AWS, Azure, or GCP.\nApply security engineering practices across identity and access management, network security, endpoint security, data protection, secrets management, containerized workloads, and cloud posture.\nImplement secure integrations using REST APIs, webhooks, event-driven workflows, message queues, infrastructure as code, and policy as code.\nUse Python, PowerShell, Bash, or similar tools to build automation, security utilities, integrations, and operational tooling.\nUse AI-assisted development tools where they improve delivery speed and quality while maintaining secure coding, testing, review, and change-management practices.\nCreate reusable deployment patterns, templates, playbooks, reference architectures, and accelerators that scale across customer engagements.\nDesign for resiliency, observability, performance, scalability, maintainability, and secure operations.\nImprove reliability through documentation, testing, monitoring, version control, and standardized engineering practices.\nCross-Functional Leadership and Practice Development\nCollaborate across Security Operations, Security Engineering, Detection Engineering, Cloud, Infrastructure, Data, Application, Platform, and customer teams.\nLead technical workshops and communicate effectively with engineering leaders, security leaders, CISOs, and other executive stakeholders.\nMentor engineers and contribute to AHEAD best practices for security engineering, customer delivery, AI security, and solution design.\nProvide field feedback to influence platform roadmaps, product direction, reusable patterns, and architectural standards.\nDefine and publish reusable security patterns, playbooks, implementation guides, and accelerators that grow AHEAD's security practice.\nSupport proposal development, solution shaping, technical scoping, and customer commercial conversations as needed.\nInfluence outcomes without direct authority while maintaining a strong customer-service and execution mindset.\nRequired Qualifications\n5+ years of experience in security engineering, security operations, detection and response, cloud security, platform security, solutions engineering, forward-deployed engineering, or related technical roles.\nDemonstrated depth in at least one cybersecurity discipline, such as application security, SecOps or detection engineering, cloud security, IAM, offensive security, or GRC.\nHands-on experience implementing or operating modern SOC technologies such as SIEM, XDR, SOAR, case management, security analytics, or threat intelligence platforms.\nExperience owning end-to-end security delivery in a customer-embedded, production, consulting, managed-services, or implementation environment.\nExperience deploying or integrating cloud-native architectures on AWS, Azure, GCP, or another major cloud platform.\nStrong understanding of security operations, incident response, detection engineering, threat hunting, cloud security, identity security, endpoint security, and security automation.\nExperience with security telemetry, data integration, normalization, enrichment, event correlation, and analytics workflows.\nExperience developing and managing detections through their full lifecycle, including use-case definition, rule or query development, testing, tuning, deployment, validation, documentation, and retirement.\nExperience managing security data sources, including parsers, schema mapping, normalization, enrichment, routing, retention, access controls, and data-quality monitoring.\nExperience with scripting and automation using Python, PowerShell, Bash, or a similar language.\nFamiliarity with APIs and integration patterns including REST, webhooks, event-driven workflows, and message queues.\nDemonstrated experience applying AI, machine learning, LLMs, or AI-assisted development to practical security use cases. Theoretical familiarity alone is not sufficient.\nWorking knowledge of AI security risks and controls relevant to LLM, RAG, agentic, or AI-enabled security workflows.\nAbility to lead technical engagements, own outcomes, drive execution, and influence without direct authority.\nProven ability to communicate technical security risk clearly to both technical and non-technical stakeholders.\nStrong problem-solving skills, structured analytical thinking, and the ability to operate effectively in ambiguous, fast-moving environments.\nTechnical Skills\nSecurity operations: SIEM, XDR, SOAR, incident response, detection engineering, threat intelligence, threat hunting, case management, and security analytics.\nDetection engineering: detection use-case development, rule and query languages, correlation logic, Sigma or platform-native content, MITRE ATT&CK mapping, detection-as-code, testing, tuning, and coverage validation.\nSIEM and security data management: parsing, schema mapping, normalization, enrichment, data-quality monitoring, ingestion health, routing, retention, access controls, and cost/performance optimization.\nCloud and infrastructure security: AWS, Azure, GCP, IAM, network security, endpoint security, secrets management, container security, and cloud posture management.\nSecurity engineering: threat modeling, secure-by-design principles, vulnerability management, security controls, logging and monitoring, production hardening, and incident response.\nAutomation and integration: Python, PowerShell, Bash, REST APIs, webhooks, event-driven architectures, message queues, CI/CD, infrastructure as code, and policy as code.\nAI security: LLM and agentic architectures, RAG, embeddings, ve...","description_format":"text","description_chars":13779,"description_truncated":true,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Incident Response","IT Consulting & Digital Transformation","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-07-14T17:20:56Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 23 · green card filings: 4","filings_12m":23,"filings_prev_12m":21,"green_card_filings_12m":4,"median_offered_wage_usd":151759,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":10}],"liveness":{"score":23,"band":"cold","label":"Long shot","p_open":1,"p_active":0.529,"p_room":0.44,"age_days":97,"expected_fill_days":71,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-20T05:45:00Z"},"pay":{"stated_usd_annual":200000,"is_top_pay":false},"html_url":"https://alion.io/job/ahead-forward-deployed-engineer-ai-soc","json_url":"https://alion.io/job/ahead-forward-deployed-engineer-ai-soc.json","meta":{"generated_at":"2026-10-20T10:27:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11368,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3614},"rest":"https://alion.io/mcp/rest/get_company?id=3614"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fahead-forward-deployed-engineer-ai-soc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fahead-forward-deployed-engineer-ai-soc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fahead-forward-deployed-engineer-ai-soc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ahead-forward-deployed-engineer-ai-soc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fahead-forward-deployed-engineer-ai-soc"}]}