Security Engineer

CipherData • Bellevue, WA

51d • Onsite

About The Position

AIDR's agents investigate every alert autonomously. Your job is to make sure they investigate the right things, the right way. You will build the detection and correlation content our agents reason over, label the real investigations that tell us whether their conclusions are correct, and work inside customer SOCs while AIDR runs in production. This is a product role, not a corporate security or compliance role. You are joining our founding security team — you will work directly with the AI engineering team and with the engineer who leads our security function, and you will see your detection work go from idea to customer environment in days. We will level this role to the person: a strong engineer with a few years of hands-on SOC or detection work will grow fast here; a senior engineer will own large pieces outright.

Requirements

• 3+ years hands-on in a SOC, detection engineering, threat hunting, or incident response role
• You have written and tuned detections in production and can explain the false-positive trade-offs you made
• Working experience with at least one SIEM or security data platform and EDR/XDR telemetry
• Working Python; comfortable in a codebase with code review, tests, and CI
• Comfort with ambiguity and ownership at an early-stage startup: you scope your own work, ask for help early, and ship

Nice To Haves

• 5+ years, including senior-level detection engineering or IR (we will level and title accordingly — Senior Security Engineer)
• Detection-as-code practice
• Cloud and identity telemetry depth
• Experience building labeled datasets or evaluations
• Familiarity with LLM-based systems and their failure modes
• Purple team, adversary emulation, or offensive security background

Responsibilities

• Write, test, tune, and retire the detection logic and correlation rules that turn multi-vendor security data into signal our agents can reason over.
• Label real investigations into the benchmark datasets that measure whether agent output is right; find and document the cases where it is confidently wrong.
• Track attacker tradecraft and turn it into detection content, test cases, and agent capability.
• Contribute to normalization, enrichment, and query patterns on our SIEM-less security lakehouse as we expand it.
• Help deploy, tune, and validate AIDR in customer environments and carry analyst feedback back into detection and evaluation.
• Participate in customer-reported and internal incident response, including analysis, documentation, and post-incident review.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level
• Education Level: No Education Listed