Principal, Cybersecurity Automation - Remote
About The Position
The Principal Security Automation & AI Engineer is the senior technical leader responsible for automation and AI across Cyber Defense. This hands-on engineering role designs, builds, and operates scalable automation and AI solutions to reduce repetitive work, accelerate security operations, and help analysts focus on higher-value decisions. The role writes code, establishes technical standards, creates foundational engineering patterns, determines where AI can safely improve operations, identifies where human oversight is required, and measures production impact. Solutions must be reliable, auditable, secure, and appropriate for the data they handle. The position owns the Cyber Defense automation roadmap and delivers security automation across alert triage, enrichment, containment, case management, notification, vulnerability management, and threat intelligence. It builds and maintains integrations across security platforms and business systems, and identifies and implements AI use cases such as triage, investigation summaries, detection development, and reporting. It also designs AI agents and assistants with least privilege, scoped tool access, human approval for consequential actions, and safeguards for risks including prompt injection, data leakage, and excessive permissions. The role applies software engineering practices to automation, detections, prompts, and AI configurations, including version control, peer review, testing, CI/CD, monitoring, error handling, runbooks, rollback, and production performance management. It partners with Security Architecture, Privacy, Legal, and IT on responsible AI governance; establishes reusable standards and reference architectures; mentors engineers and analysts; measures operational outcomes; and communicates technical concepts, risks, and limitations to technical and executive audiences. The job is remote, with preference for candidates in Eastern or Central time zones. Travel is 10%.
Requirements
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field, or an equivalent combination of education and relevant professional experience.
- 8+ years of relevant experience in cybersecurity, security engineering, software engineering, automation, or related technology disciplines.
- Demonstrated experience designing, deploying, and operating production security automation at enterprise scale.
- Strong Python development skills and working proficiency in SQL and API integrations, including REST APIs, webhooks, authentication, and OAuth.
- Experience building and operating production LLM-based solutions, including AI agents, retrieval-augmented generation, prompt design, tool integration, and evaluation.
- Experience implementing controls for AI-specific security risks, including prompt injection, data leakage, excessive agency, and inappropriate access.
- Strong understanding of SOC and incident response operations, detection engineering, and MITRE ATT&CK.
- Experience applying software engineering practices including Git, code review, automated testing, CI/CD, observability, and production support.
- Demonstrated ability to establish technical direction and deliver complex solutions across teams through influence rather than direct authority.
- Must be legally authorized to work in the U.S. and not require employment-based sponsorship now or in the future.
Nice To Haves
- Experience with enterprise SOAR and security automation platforms.
- Hands-on experience integrating technologies such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, CrowdStrike, ServiceNow, or comparable enterprise security platforms.
- Experience with cloud and AI platforms such as Microsoft Azure, Azure AI Foundry, Azure OpenAI, AWS, or comparable technologies.
- Experience designing agentic AI workflows that incorporate human-in-the-loop controls, evaluation frameworks, secure tool use, and production monitoring.
- Knowledge of AI security and governance frameworks such as the NIST AI Risk Management Framework and OWASP guidance for LLM and generative AI applications.
- Relevant cybersecurity, cloud, software engineering, or AI certifications.
Responsibilities
- Own and prioritize the Cyber Defense automation roadmap based on analyst capacity gained, risk reduction, business impact, and implementation effort.
- Design, build, and operate automation for alert triage, enrichment, containment, case management, and notification.
- Extend automation across vulnerability management and threat intelligence, including asset context, remediation tracking, and indicator handling.
- Build and maintain integrations across endpoint security, detection engineering, security data platforms, asset inventory, threat intelligence, and ticketing systems.
- Identify and implement high-value AI use cases across security operations, including triage, investigation summaries, detection development, and reporting.
- Design, build, and operate AI agents and assistants using least privilege, scoped tool access, and human approval for consequential actions.
- Develop evaluation frameworks to measure accuracy, reliability, consistency, and failure modes before and after deployment.
- Implement safeguards against prompt injection, data leakage, and excessive agent permissions, and keep regulated data within approved environments.
- Evaluate vendor AI capabilities against internally developed solutions and provide build, buy, or wait recommendations.
- Apply version control, peer review, automated testing, CI/CD, and appropriate change controls to automation, detections, prompts, and AI configurations.
- Operate production automation with monitoring, error handling, runbooks, rollback capabilities, and ongoing performance management.
- Partner with Security Architecture, Privacy, Legal, and IT teams to support responsible AI governance and risk management.
- Establish engineering standards, reusable patterns, and reference architectures for security automation and AI.
- Mentor engineers and analysts to expand safe, scalable automation capabilities across Cyber Defense.
- Define and report measurable outcomes such as analyst hours returned, time to triage and containment, automation coverage, reliability, and error rates.
- Translate complex automation and AI concepts, capabilities, risks, and limitations for technical teams and executive audiences.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
