{"id":2413764,"url":"https://alion.io/job/first-american-principal-engineer-agentic-security-operations-remote","title":"Principal Engineer - Agentic Security Operations (remote)","company":{"id":8115,"name":"First American","domain":"firstam.com","url":"https://alion.io/company/first-american","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":77,"open_postings":45,"ghost_share":0,"stale_share":0.889,"repost_share":0.022,"time_to_fill_p50_days":31,"computed_at":"2026-10-13T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Santa Ana, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":170900,"max":227900,"currency":"USD","period":"year","gross":null,"usd_annual":227900},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Databricks","optional":false},{"name":"Function Calling","optional":false},{"name":"GCP","optional":false},{"name":"Human-in-the-Loop","optional":false},{"name":"Least Privilege","optional":false},{"name":"Snowflake","optional":false},{"name":"Tool Use","optional":false},{"name":"Knowledge Graph","optional":true},{"name":"RAG","optional":true}],"status":"live","first_seen_at":"2026-10-12T00:00:00Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-13T06:38:28Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Who We Are\nJoin a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people-first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For® list for eleven consecutive years. We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit www.careers.firstam.com. What We Do\nOur Security Operations Center (SOC) protects the enterprise by detecting, investigating, and responding to cybersecurity threats.As a member of our Threat Detection Engineering team operating within our SOC, you will build governed agent capabilities to support data onboarding, detection engineering, threat hunting, investigation, response, automation, and platform operations. Our goal is to expand threat visibility, accelerate security outcomes, reduce repetitive work, and improve operational consistency and resilience without compromising sound security judgment, human accountability, or control.\nThe Principal Engineer provides hands-on technical leadership to turn this strategy into secure, reliable, and supportable production capabilities across the SOC.\n*We are open to remote candidates for this role\nWhat You’ll Do\n\nLead the architecture and hands-on implementation of Agentic Security Operations capabilities across the SOC.\nDefine and evolve the reference architecture for governed data services, agent capabilities, workload routing, execution environments, and deterministic orchestration.\nBuild reusable capabilities that translate operational intent into tested, reviewable, and auditable security outcomes.\nEstablish engineering standards for creating, testing, registering, approving, releasing, monitoring, and retiring agents and their capabilities.\nAdvance detection-as-code practices, including versioning, simulation, deployment, tuning, migration, and rollback.\nBuild governed knowledge and context services that provide authoritative documentation, policies, operational history, citations, freshness information, and permission-aware retrieval.\nDesign workload identity, least-privilege access, short-lived authorization, spend controls, approval gates, audit trails, rollback, and emergency shutdown mechanisms.\nDefine autonomy levels that determine which activities may execute automatically, require human approval, or remain analyst led.\nEstablish agent evaluation and observability through historical replay, synthetic scenarios, expected-versus-actual comparisons, policy tests, traces, outcome verification, and regression testing.\nMeasure quality, security, reliability, latency, cost, analyst acceptance, and operational impact.\nEngineer reliable integrations across search, case management, workflow, communications, and response systems, including retries, idempotency, partial failures, and reconciliation.\nEnsure consequential response actions remain deterministic, attributable, reversible, and subject to appropriate human oversight.\nDesign production reliability, continuity, recovery, and support models for agent capabilities and security data services.\nLead proofs of concept and architecture evaluations using measurable criteria for security, fidelity, scale, reliability, portability, operating effort, and economic value.\nCollaborate with enterprise architecture, infrastructure, data, risk, privacy, legal, and compliance teams.\nMentor engineers, establish technical standards, review designs, and influence Threat Detection Engineering strategy.\nPresent complex technical decisions, risks, tradeoffs, and investment recommendations clearly to engineering and executive stakeholders.\nPartner across Threat Detection and Response groups, including engineering, threat hunting, security analysis, investigation, and incident response stakeholders on initiatives and to translate operational feedback into improvements within our agentic harness, evaluations, safeguards, workflows, and other platforms.\nWhat You’ll Bring\n\nExtensive experience designing and operating enterprise security, software, data, or distributed systems at scale.\nDemonstrated success as a principal-level technical leader while remaining actively involved in architecture, prototyping, coding, testing, and production delivery.\nHands-on experience delivering production AI-assisted or agentic systems that use tools, memory, retrieval, planning, and structured workflows.\nStrong understanding of security operations, including telemetry management, detection engineering, threat hunting, triage, investigation, response, and automation.\nExperience with high-volume streaming and batch data pipelines, object-based storage, elastic analytics, distributed query, schema management, and data-quality controls.\nExperience designing modular agents, reusable capabilities, workload routing, local and managed execution, and human-in-the-loop workflows.\nDeep understanding of grounding, retrieval, source attribution, context freshness, permission inheritance, and protection against untrusted or manipulated context.\nExperience evaluating nondeterministic systems using versioned test sets, historical replay, synthetic scenarios, regression testing, and measurable outcome criteria.\nStrong software-engineering practices, including source control, automated testing, continuous delivery, infrastructure automation, peer review, and rollback.\nExperience designing secure APIs, event-driven integrations, workload identities, authorization boundaries, secrets management, and auditable action execution.\nKnowledge of AI security risks such as prompt injection, data poisoning, excessive agency, sensitive-data exposure, insecure tool use, and model or workflow drift.\nStrong production-engineering experience covering observability, service objectives, capacity, failure isolation, continuity, recovery, and operational support.\nAbility to evaluate emerging capabilities critically, distinguish demonstrated functionality from product claims, and validate architectural assumptions through controlled testing.\nExcellent written and verbal communication skills, including the ability to document architectures, operating models, engineering standards, and executive recommendations.\nAbility to lead through influence and work effectively across organizational and technical boundaries.\nHands-on experience with cloud-scale data and analytics platforms supporting security operations, including distributed query, high-volume data processing, object storage, schema management, data pipelines, and the operational patterns required to run security analytics at scale (e.g., Databricks, Snowflake, etc.) \nExperience operating and migrating security analytics and detection workloads across modern platforms, along with strong working knowledge of major public cloud environments (AWS, Azure, GCP) and the identity, networking, logging, data protection, and workload-security controls required to secure them.\nA minimum of 10 years’ experience in cybersecurity or relevant fields.\nBachelor’s degree in computer science, Information Technology, Cybersecurity, a related field, or equivalent work experience.\nPreferred certifications such as, GASAE, GAIPS, GDSA, GCDA, CEH, OSCP, CISSP, etc.\nPreferred Qualifications\n\nExperience modernizing a centralized security analytics environment into a decoupled architecture with customer-controlled data and replaceable compute or control layers.\nExperience with knowledge graphs, entity resolution, semantic normalization, retrieval-augmented systems, or multi-agent coordination.\nExperience migrating security content while validating semantic equivalence, historical fidelity, and operational parity.\nBackground in detection engineering, incident response, threat hunting, adversary emulation, or security automation.\nExperience defining governance and autonomy frameworks for AI-enabled production systems.\nExperience building internal platforms or shared engineering services used by multiple security functions.\nWhat Success Looks Like\n\nA leadership-approved Agentic Security Operations reference architecture and governance model.\nGoverned agent prototypes progressing into reliable production capabilities.\nReusable capabilities spanning data, detection, automation, and other SOC functions.\nMeasurable reductions in engineering effort and operational cycle time without sacrificing security or human accountability.\nContinuous evidence that agent capabilities are accurate, secure, reliable, explainable, cost-effective, and safe to operate.\nA production platform with clear ownership, support procedures, recovery controls, and an intentional path away from vendor or architecture lock-in.\nPay Range: $170,900.00 - $227,900.00 AnnuallyThis hiring range is a reasonable estimate of the base pay range for this position at the time of posting. Pay is based on a number of factors which may include job-related knowledge, skills, experience, business requirements and geographic location.** Note that the following statements only apply to candidates who will be working from an unincorporated area within Los Angeles County. **\nFirst American will consider for employment all qualified applicants, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws (e.g., the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act).\nFirst American intends to conduct a review of an applicant’s criminal history in connection with a conditional offer. First American reasonably believes that a criminal history may have a direct, adverse and negative relationship with the following material job duties for this position potentially resulting in the withdrawal of the conditional offer of employment: handling of confidential, proprietary or trade secret information belonging to First American or its customers, administrating or facilitating financial transactions, and the ability to meet customer-imposed criminal history requirements.\nWhat We Offer\nBy choice, we don’t simply accept individuality - we embrace it, we support it, and we thrive on it! Our People First culture is inclusive for all employees - not just because it's the right thing to do, but because it's the key to our success. We are proud to foster an authentic and inclusive workplace For All. You are free and encouraged to bring your entire, unique self to work. First American is an equal opportunity employer in every sense of the term.Based on eligibility, First American offers a comprehensive benefits package including medical, dental, vision, 401k, PTO/paid sick leave and other great benefits like an employee stock purchase plan.","description_format":"text","description_chars":11108,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Property & Casualty Insurance","Incident Response","Real Estate Appraisal"],"lifecycle":[{"event":"open","at":"2026-10-13T02:45:09Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":1,"expected_fill_days":31,"reasons":["conf:2","stale_co","win:early","comp:brand"],"computed_at":"2026-10-13T05:45:00Z"},"pay":{"stated_usd_annual":227900,"is_top_pay":true},"html_url":"https://alion.io/job/first-american-principal-engineer-agentic-security-operations-remote","json_url":"https://alion.io/job/first-american-principal-engineer-agentic-security-operations-remote.json","meta":{"generated_at":"2026-10-13T20:21:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":31302,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8115},"rest":"https://alion.io/mcp/rest/get_company?id=8115"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffirst-american-principal-engineer-agentic-security-operations-remote"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffirst-american-principal-engineer-agentic-security-operations-remote"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffirst-american-principal-engineer-agentic-security-operations-remote"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/first-american-principal-engineer-agentic-security-operations-remote\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffirst-american-principal-engineer-agentic-security-operations-remote"}]}