AI Engineer in Cybersecuirty

AI Engineer

Global Enterprise Security | AI Engineering

Team Overview

GES AI Engineering is a small, high-leverage team that builds agentic AI and automation capability for Global Enterprise Security as a whole — not for a single program. The team is chartered to build once, reuse everywhere: shared agent platforms, evaluation tooling, and automation patterns that any GES team can adopt.

The team is four AI Engineers that are assigned to GES priorities as they arise rather than to one fixed team's tooling. An engineer's specific assignment will change over time as GES leadership reprioritizes; what stays constant is the underlying skill set below. Engineers cross-cover each other's assignments during surges, incidents, or absences.

Role Overview

The AI Engineer designs, builds, and operates agentic AI workflows and automation on behalf of Global Enterprise Security's teams — most often as an embedded partner rather than the workflow's eventual owner. This is a builder role: the engineer scopes a partner team's problem, prototypes an agent or automation against it on a shared platform (for example AWS Bedrock or an equivalent managed model platform), proves it is accurate and safe, and either hands it to the partner team to operate or keeps it running as a shared GES capability.

Assignments are expected to vary — a given engineer might spend a quarter embedded with a detection team, the next building a fleet-scale automation, and the one after that prototyping something for a team that has never used agentic tooling before. Because of that, this position is hired against durable capability, not against a fixed backlog: how quickly and safely the engineer can turn an unfamiliar security workflow into a working, trustworthy automation.

What You'll Do

Problem Scoping and Solution Design

• Take an ambiguous, partner-team-described problem in any security domain and scope a narrow, testable first version of it — clarifying what good looks like before writing code.
• Choose the right automation or agentic pattern for the problem at hand (deterministic automation, retrieval-augmented response, tool/function-calling agent, multi-step orchestration) rather than defaulting to the most complex option available.
• Identify which parts of a partner team's workflow are high-volume and low judgment (good automation candidates) versus which require human decision-making and design the human/agent boundary accordingly.
• Assess data availability, access, and integration requirements early, and flag when a proposed assignment isn't yet ready for an AI-assisted solution.

Agentic Workflow and Automation Engineering

• Build agents and automation on the organization's shared model and orchestration platform(s) (for example AWS Bedrock or a comparable managed platform), including model selection/routing, tool and function definitions, and context and retrieval management.
• Build integrations and tool interfaces — including MCP servers or equivalent connectors — that give an agent scoped, least-privilege access to the data and systems it needs, and no more.
• Develop and maintain automation or agent logic as code: version control, peer review, staged promotion from development through production, and rollback capability.
• Write clean, maintainable Python and API integrations that a teammate can pick up and extend without the original author in the room.

Evaluation, Safety, and Production Hardening(Following skills are plus but not mandatory)

• Build an evaluation harness for every assignment before calling it done — golden examples, precision/recall or task-success measurement, and hallucination/false-action detection — and use it to decide whether a prototype is ready to progress.
• Define human-in-the-loop approval gates for any destructive or high-impact action, and ensure every automated or agent-driven action is logged, attributable, and reversible where feasible.
• Monitor deployed workflows for drift, degraded accuracy, and cost or rate-limit issues, and respond before they become incidents.
• Apply a bias toward measured autonomy: earn expanded authority for automation by demonstrating accuracy in the partner team's environment, not by assumption.

Shared Platform Contribution and Reuse

• Contribute to the shared agentic AI platform used across GES — model routing, guardrails, connectors, and evaluation tooling — so the next assignment starts from a stronger foundation than the last.
• Default to reusing existing connectors, patterns, and evaluation tooling across assignments rather than building bespoke solutions and generalize a one-off build into a shared component when it's likely to be needed again.
• Track and report what was automated, how much manual effort it removed, and where the next-highest-value assignment likely is.

AI Governance, Security, and Assurance

• Apply secure design and secure coding practices to all automation and agent code; treat model inputs, tool outputs, and third-party content as untrusted, knowledge on this is a plus.
• Working knowledge of implementing and validating controls against prompt injection, tool misuse, excessive agency, and sensitive data leakage in every deployment, regardless of which team it's built for, is a plus.
• Knowledge of maintaining evidence supporting applicable compliance obligations (for example PCI DSS, NIST CSF, CIS Controls, CMMC) for anything the engineer builds or operates, and work with GRC, Privacy, and Architecture on model approval and multi-tenant data boundaries is plus.

Enablement and Cross-Team Collaboration (Following skills are a plus but not mandatory)

• Document every workflow, agent, and its known limitations well enough that the receiving team can operate and trust it without the AI Engineering team in the room.
• Train and coach partner-team staff on how to use, question, and escalate around AI-assisted output.
• Evaluate emerging agentic and automation platforms relevant to a current or upcoming assignment, and produce clear, evidence-based build-versus-buy recommendations.
• Work comfortably as an embedded partner inside a team that isn't your own — building trust quickly, respecting existing process, and transferring ownership cleanly when an engagement ends.

Required Qualifications

• Six or more years in software, security, or platform engineering, including experience building and shipping automation or AI-assisted tooling into production.
• Hands-on experience building agentic workflows on at least one managed model platform (for example AWS Bedrock, Azure AI Foundry, or a comparable agent-orchestration platform), including model selection/routing, tool and function calling, and context/retrieval management.
• Having Knowledge on Cybersecurity specialization to build from — one or more of: security operations/detection engineering, offensive security, identity and access, cloud security, GRC/risk, or vulnerability and fleet management — with enough depth to design a workflow a specialist in that domain would trust is a plus but not mandatory.
• Demonstrated ability to scope an ambiguous problem quickly and deliver a credible first working version, then iterate based on evaluation results rather than intuition.
• Strong Python development skills, with proven experience building and consuming REST APIs and integrating disparate enterprise tooling.
• Practical experience with at least one major cloud provider (AWS, Azure, or GCP), including IAM concepts and least-privilege service credentials, knowledge on this is added advantage.
• Version control and CI/CD discipline: Git-based workflow, peer review, and automated testing.
• Demonstrated experience building agent evaluation approaches — golden datasets, precision/recall or task-success measurement, hallucination and false-action detection.
• Clear written communication; able to document a workflow well enough that a non-builder on the receiving team can operate it unaided.
• Comfort with ambiguity and reprioritization: this role is defined by capability, not by a fixed project backlog, and assignments will change.

Preferred Qualifications

• Knowledge of SOAR platform (Splunk SOAR, Torq, Tines, Swimlane, Cortex XSOAR, or equivalent) or an agentic security platform used for triage, enrichment, or response.
• Experience implementing or securing MCP servers or comparable agent tool interfaces is a plus.
• Familiarity with AI risk frameworks including the OWASP Top 10 for LLM Applications, NIST AI RMF, and MITRE ATLAS is a plus.
• Detection engineering background: MITRE ATT&CK mapping, detection-as-code, SIEM query languages and data models is a plus.
• Knowledge on fleet/endpoint management and patch automation tooling, or with infrastructure as code (Terraform) and Kubernetes is a plus.
• Multi-tenant or managed service provider operations experience is plus.
• Certifications such as AWS Security Specialty, AWS Certified Machine Learning, GCIA, GCIH, GCDA, AZ-500, or SC-200 is good have but not mandatory.

What Success Looks Like

Success in this role means bringing engineering judgment and safety discipline to every problem GES hands you, regardless of which team or platform it touches.

The AI Engineer will help ensure that automation and agentic AI are applied where they genuinely reduce risk, effort, or delay for a partner team - not simply because the technology is available or the assignment calls for something impressive. They will investigate what a workflow requires before building anything, identify where human judgment must stay in the loop, gather the evaluation evidence needed to show a solution is accurate and safe, and scope how much autonomy that solution has earned.

This role will help strengthen the connection between a partner team's real operational problem, the automation or agent built to address it, and the shared AI Engineering platform underneath it - so that trust, reuse, and safe autonomy compound across GES rather than resetting with every new assignment.

Working Expectations

• Operates under formal change management for anything touching production, customer-facing, or partner-team environments.
• Participates in a shared on-call rotation for platform availability and major incident support alongside the AI SOC Engineer.
• Assignments are set by GES leadership based on current priorities and may shift with limited notice; the engineer is expected to ramp on a new problem domain efficiently.
• Cross-covers teammates assignments during surges, incidents, or absences.