{"id":120864,"url":"https://alion.io/job/saviynt-ai-detection-engineer-soc-analyst-iv","title":"AI Detection Engineer - SOC Analyst IV","company":{"id":5841,"name":"Saviynt","domain":"saviynt.com","url":"https://alion.io/company/saviynt","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":93,"open_postings":62,"ghost_share":0.032,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":158,"computed_at":"2026-10-29T05:49:05Z"}},"role":"AI/ML","role_family":"AI/ML","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":28000,"max_usd":58000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":41},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Fine-tuning","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"Kubernetes","optional":false},{"name":"Machine Learning","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Red Teaming","optional":true},{"name":"Scikit-learn","optional":true}],"status":"live","first_seen_at":"2026-03-20T07:24:59Z","employer_posted_date":"2026-03-20","last_verified_at":"2026-10-29T14:19:01Z","board_verified":true,"closed_at":null,"days_open":223,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":222},"description":"About the Job\nWe are building a next-generation Agentic Security Operations Center (SOC) designed for the AI era. We believe that effective security operations must evolve beyond traditional reactive methods. We are building an intelligent, AI-driven SOC that combines deep cloud security expertise with advanced automation and machine learning to predict, prevent, and neutralize advanced threats faster than ever.\nWe are seeking a SOC Detection Engineer - Cloud and AI Automation to serve as a technical expert responsible for designing, building, and optimizing detection capabilities across our cloud-native security stack. This is a hands-on-keyboard role for someone who thrives on creating intelligent detections, leveraging AI/ML for threat identification, and building automation that scales security operations. You will be responsible for engineering detection logic, fine-tuning AI-powered alerts, and driving continuous improvement in our detection and response capabilities.\nWHAT YOU WILL BE DOING\nDetection Engineering & Content Development\nDesign, develop, and deploy advanced detection rules and logic across SIEM, EDR, CSPM, and cloud-native security platforms.\nBuild and maintain detection-as-code using modern frameworks and version control systems (Git).\nCreate high-fidelity, low-noise detections mapped to the MITRE ATT&CK framework, focusing on cloud-specific threats and techniques.\nContinuously research emerging threats, TTPs (Tactics, Techniques, and Procedures), and translate threat intelligence into actionable detection content.\nPerform detection efficacy testing and validation using purple team exercises and adversary emulation frameworks.\nAI & Machine Learning Integration\nLeverage AI/ML capabilities within security platforms to enhance threat detection accuracy and reduce false positives.\nBuild and tune machine learning models for anomaly detection, behavioral analytics, and predictive threat identification.\nIntegrate generative AI and large language models (LLMs) to accelerate alert triage, investigation workflows, and threat analysis.\nEvaluate and implement AI-powered security tools for automated threat detection, alert enrichment, and investigation assistance.\nMonitor and optimize AI/ML model performance, addressing data quality, model drift, and false positive/negative rates.\nCloud Security Detection & Monitoring\nAct as a Subject Matter Expert (SME) for cloud security detection engineering across AWS, Azure, and GCP environments.\nDesign detections leveraging cloud-native logs (CloudTrail, Azure Activity Logs, GCP Audit Logs) and security services (GuardDuty, Security Command Center, Defender for Cloud).\nBuild detections for cloud-specific threats including misconfigurations, identity compromise, data exfiltration, and infrastructure attacks.\nMonitor container and Kubernetes environments, developing detections for runtime threats and supply chain attacks.\nSecurity Automation & Orchestration\nDesign and implement automated detection deployment pipelines using secure CI/CD methodologies.\nBuild custom scripts (Python, PowerShell, Bash) for automated alert enrichment, evidence collection, and response actions.\nDevelop and maintain automated response playbooks in SOAR platforms to handle detection-triggered workflows.\nIntegrate security tools via APIs to create seamless, automated detection and response ecosystems.\nIdentify opportunities to apply automation and AI to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).\nContinuous Improvement & Collaboration\nAnalyze detection performance metrics, false positive rates, and coverage gaps to drive continuous improvement.\nCollaborate with threat intelligence, incident response, and threat hunting teams to refine detection strategies.\nCreate and maintain comprehensive documentation for detection logic, tuning procedures, and operational runbooks.\nProvide technical guidance on detection engineering best practices and emerging technologies.\nStay current with the latest security research, adversary techniques, and AI/ML\nadvancements in cybersecurity.\nWHAT YOU BRING\nBachelor's degree in Computer Science, Information Security, Data Science, or a\nrelated field.\n8-12 years of experience in cybersecurity with at least 4+ years focused on detection engineering, threat detection, or security analytics.\nStrong Cloud Security Detection Skills: Deep, hands-on experience building detections for at least one major cloud provider (AWS, Azure, or GCP), including native security services and log sources.\nAI/ML Security Experience: Practical experience applying machine learning, anomaly detection, or AI-powered tools to security use cases. Understanding of AI/ML model development, tuning, and evaluation.\nDetection Engineering Expertise: Proven track record of creating high-quality detection content using SIEM platforms (Splunk, Azure Sentinel, Chronicle), EDR solutions (CrowdStrike, Microsoft Defender), and cloud security tools.\nAutomation & Scripting Proficiency: Strong programming skills in Python (required), with experience in PowerShell or Bash. Ability to build detection pipelines and automation frameworks.\nTechnical Depth: Hands-on experience with SOAR platforms, detection-as-code frameworks, log analysis, and data correlation techniques.\nMITRE ATT&CK Mastery: Expert-level understanding of the MITRE ATT&CK framework and its application to detection engineering and threat modeling.\nAnalytical Mindset: Strong problem-solving skills with the ability to analyze complex data sets, identify patterns, and translate findings into detection logic.\nGood to Have\nCertifications: GIAC Certified Detection Analyst (GCDA), GIAC Cyber Threat Intelligence (GCTI), AWS Certified Security Specialty, Azure Security Engineer Associate, or equivalent.\nExperience with threat intelligence platforms (TIPs) and threat hunting methodologies.\nKnowledge of adversary emulation tools (Atomic Red Team, Caldera,etc.).\nFamiliarity with data science tools and frameworks (Jupyter, pandas, scikit-learn).\nContributions to open-source detection content repositories (Sigma rules, detection\nrules, etc.).","description_format":"text","description_chars":6127,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Identity Management","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-03-20T07:24:59Z"}],"visa":[],"liveness":{"score":34,"band":"fade","label":"Fading","p_open":1,"p_active":0.778,"p_room":0.44,"age_days":222,"expected_fill_days":158,"reasons":["conf:0","velocity","win:tail","crowd:"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/saviynt-ai-detection-engineer-soc-analyst-iv","json_url":"https://alion.io/job/saviynt-ai-detection-engineer-soc-analyst-iv.json","meta":{"generated_at":"2026-10-29T16:09:30Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24073,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5841},"rest":"https://alion.io/mcp/rest/get_company?id=5841"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsaviynt-ai-detection-engineer-soc-analyst-iv"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsaviynt-ai-detection-engineer-soc-analyst-iv"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsaviynt-ai-detection-engineer-soc-analyst-iv"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/saviynt-ai-detection-engineer-soc-analyst-iv\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsaviynt-ai-detection-engineer-soc-analyst-iv"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":120864}},{"tool":"search_jobs","arguments":{"company":"saviynt.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":120864},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}