Principal, Cybersecurity Automation

Stryker•Kalamazoo, MI

3d•Remote

About The Position

The Principal Security Automation & AI Engineer is the senior technical leader responsible for automation and AI across Cyber Defense. This hands-on engineering role designs, builds, and operates scalable automation and AI solutions to reduce repetitive work, accelerate security operations, and let analysts focus on higher-value decisions. The role writes code, establishes technical standards, builds foundational patterns, determines where AI can safely improve security operations, defines where human oversight is needed, and measures production impact. Solutions must be reliable, auditable, secure, and appropriate for the data they handle. The position is remote; candidates in Eastern or Central time zones are preferred to support collaboration during core business hours. Travel is 10%.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field, or an equivalent combination of education and relevant professional experience.
8+ years of relevant experience in cybersecurity, security engineering, software engineering, automation, or related technology disciplines.
Demonstrated experience designing, deploying, and operating production security automation at enterprise scale.
Strong Python development skills and working proficiency in SQL and API integrations, including REST APIs, webhooks, authentication, and OAuth.
Experience building and operating production LLM-based solutions, including AI agents, retrieval-augmented generation, prompt design, tool integration, and evaluation.
Experience implementing controls for AI-specific security risks, including prompt injection, data leakage, excessive agency, and inappropriate access.
Strong understanding of SOC and incident response operations, detection engineering, and MITRE ATT&CK.
Experience applying software engineering practices including Git, code review, automated testing, CI/CD, observability, and production support.
Demonstrated ability to establish technical direction and deliver complex solutions across teams through influence rather than direct authority.
Must be legally authorized to work in the U.S. and not require employment-based sponsorship now or in the future.

Nice To Haves

Experience with enterprise SOAR and security automation platforms.
Hands-on experience integrating technologies such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, CrowdStrike, ServiceNow, or comparable enterprise security platforms.
Experience with cloud and AI platforms such as Microsoft Azure, Azure AI Foundry, Azure OpenAI, AWS, or comparable technologies.
Experience designing agentic AI workflows that incorporate human-in-the-loop controls, evaluation frameworks, secure tool use, and production monitoring.
Knowledge of AI security and governance frameworks such as the NIST AI Risk Management Framework and OWASP guidance for LLM and generative AI applications.
Relevant cybersecurity, cloud, software engineering, or AI certifications are a plus.

Responsibilities

Own and prioritize the Cyber Defense automation roadmap based on analyst capacity gained, risk reduction, business impact, and implementation effort.
Design, build, and operate automation for alert triage, enrichment, containment, case management, and notification.
Extend automation across vulnerability management and threat intelligence, including asset context, remediation tracking, and indicator handling.
Build and maintain integrations across endpoint security, detection engineering, security data platforms, asset inventory, threat intelligence, and ticketing systems.
Identify and implement high-value AI use cases across security operations, including triage, investigation summaries, detection development, and reporting.
Design, build, and operate AI agents and assistants using least privilege, scoped tool access, and human approval for consequential actions.
Develop evaluation frameworks to measure accuracy, reliability, consistency, and failure modes before and after deployment.
Implement safeguards against prompt injection, data leakage, and excessive agent permissions while keeping regulated data within approved environments.
Evaluate vendor AI capabilities against internally developed solutions and provide build, buy, or wait recommendations.
Treat automation, detections, prompts, and AI configurations as code using version control, peer review, automated testing, CI/CD, and appropriate change controls.
Operate production automation with monitoring, error handling, runbooks, rollback capabilities, and ongoing performance management.
Partner with Security Architecture, Privacy, Legal, and IT teams to support responsible AI governance and risk management.
Establish engineering standards, reusable patterns, and reference architectures for security automation and AI.
Mentor engineers and analysts to expand safe, scalable automation capabilities across Cyber Defense.
Define and report measurable outcomes such as analyst hours returned, time to triage and containment, automation coverage, reliability, and error rates.
Translate complex automation and AI concepts, capabilities, risks, and limitations for technical teams and executive audiences.