AI Systems Engineer (Cyber Detection Engineering)

BMO•Toronto, ON

2d•CA$82,800 - CA$154,800•Hybrid

About The Position

This role is within the Detection Engineering & Automation function of the Global Security Operations Center (GSOC) within the Cybersecurity domain. The AI Systems Engineer (Detection Engineering) is responsible for designing and operating AI‑driven detection engineering systems, with a focus on agent orchestration, workflow automation, and token‑efficient AI usage. This role is central to the organization’s transition to a Modern SOC, where detection development is performed primarily by LLMs, automation pipelines, and orchestrated agent systems, rather than manual engineering. Development of detections within the cybersecurity domain for the purposes of identifying external threats attempting to compromise the organization is the core focus area for this role.

Requirements

Bachelor Degree or higher in Cybersecurity or Engineering or any other relevant discipline
Deep, hands-on experience using modern AI tools both personally and professionally
Proven expertise working with frontier LLMs (e.g., Claude, GPT-class models)
Experience designing or implementing AI workflows, Multi-agent or orchestrated systems, Tool-augmented LLM pipelines
Strong understanding of Prompt engineering, Context window management, Token optimization strategies
Experience building deterministic systems alongside AI (e.g., Python-based workflows, services, or automation)
Strong programming skills (e.g., Python or similar)
Foundational experience in cybersecurity (e.g., SOC, detection engineering, or security tooling)
Ability to operate effectively in ambiguous, fast-evolving environments

Nice To Haves

Experience with AWS Bedrock or similar enterprise AI platforms
Experience with Splunk, SIEM, or detection engineering workflows
Exposure to SOAR platforms, particularly Splunk SOAR
Experience generating or managing SOAR playbooks via AI or automation
Familiarity with detection-as-code, CI/CD, or DevOps practices
Experience working in regulated environments

Responsibilities

Designing AI systems, not writing cyber detections manually, where cyber detections are generated, validated, and maintained by AI workflows
Orchestrating agents and workflows, not relying on single-model reasoning
Using AI selectively and efficiently, combining LLMs with deterministic code (e.g., Python) wherever more reliable
Experienced with commercial AI tools and frontier models, actively explores the cutting edge, and understands how to engineer systems that minimize cost, maximize reliability, and avoid unnecessary AI usage.
Translate detection requirements into: Structured prompts, Agent workflows, Deterministic processing pipelines
Focus on system design over manual implementation, ensuring outputs are scalable and repeatable
Design Agent Orchestration & Workflow Engineering (Design and implement multi-agent systems for detection engineering, including: Orchestrators that break down complex tasks, Specialized sub-agents for Detection generation, Tuning and false-positive reduction, Context enrichment, Documentation and validation)
Define and optimize agent interaction patterns (chaining, feedback loops, tool usage)
Integrate agent workflows into engineering and operational pipelines
Intelligent Use of AI vs Deterministic Code by designing solutions that minimize unnecessary reliance on LLM reasoning
Build orchestration tooling and deterministic workflows (e.g., Python services, rule engines, validation layers)
Perform Context Engineering (window optimization, compression, re-use, RAG, stateless/stateful workflow design) & Token Optimization (token consumption, latency, cost)
Act as a subject matter expert in commercial AI tooling, including: GitHub Copilot, Claude (Sonnet / Opus) or equivalent frontier LLMs, Enterprise AI platforms (e.g., AWS Bedrock or similar)
Detection‑as‑Code & Pipeline Integration of AI systems into detection‑as‑code pipelines, ensuring detection artifacts are generated, validated, and deployed automatically, outputs are versioned, traceable, and auditable, embed AI workflows into CI/CD processes for detection generation, testing and validation, continuous tuning and maintenance
Cybersecurity Context & Detection Enablement (guide AI systems, including Adversary behaviors and attack techniques, Threat intelligence and incident learnings).