Senior Software Engineer

Huntress

11h•$165,000 - $190,000•Remote

About The Position

Huntress is building an Agentic SOC, a system where an LLM-based agent investigates security signals end-to-end. This system gathers telemetry, reconstructs events, and determines if activity is malicious. It aims to augment human analysts by handling high-volume, repetitive tasks, allowing them to focus on complex cases and intrusions. The system processes a large volume of signals daily across thousands of organizations, making critical decisions that require accuracy and transparency. As a Senior Software Engineer on the Agentic SOC team, you will build and ship core components of this system, working closely with technical leads, SOC analysts, product researchers, and product managers. You will own features from conception to production, utilizing AI coding tools to accelerate development.

Requirements

6+ years of professional software development experience, including building and operating production backend systems.
Experience building applications with LLMs, including tool use, structured output, prompt and context design, and evaluation.
An understanding of how LLM-based systems fail, and good habits for testing and debugging non-deterministic behavior.
Solid backend fundamentals, including APIs, background jobs and queues, concurrency, relational databases (e.g., Postgres), and data stores (e.g., Redis).
Strong skills in one or more backend languages and the ability to pick up new ones quickly (primary stack is Ruby on Rails).
Security awareness: understanding of untrusted input, access control, and data separation between customers.
Curiosity about security analysts' thought processes and willingness to learn from them.
Experience with AWS, Azure, or other public cloud environments.
Experience with AI coding tools, such as Claude Code.
BS or MS in Computer Science or Engineering, or equivalent experience.

Nice To Haves

Experience shipping agents to production.
Experience working in or building for a SOC, incident response, threat hunting, or detection engineering.
Familiarity with endpoint, identity, and Microsoft 365 telemetry and with attacker tradecraft (e.g., MITRE ATT&CK).
Experience building evaluation pipelines or datasets for ML or LLM systems.
Experience with Ruby on Rails.

Responsibilities

Build the investigation system: design, build, and ship components for agentic investigation, including tools for querying telemetry, investigation logic, and structured output for analysts and customers.
Turn analyst expertise into agent behavior: collaborate with SOC analysts and product researchers to understand triage and investigation processes, and encode this into agent logic and explanations.
Take toil off analysts’ plates: build LLM-powered features that pre-process tool outputs, summarizing, correlating, and highlighting key information for analysts.
Measure what you ship: build and extend evaluations to track system performance and improvements, backing changes with evidence.
Build with a security mindset: consider potential misuse or manipulation of the agent, designing for security given its access to attacker-influenced data and ability to take action in customer environments.
Build for production: write reliable, observable, cost-conscious code that handles model slowness, errors, or unavailability. Operate what you build and maintain system health.
Collaborate and raise the bar: provide thoughtful code reviews, assist teammates, share knowledge about building with LLMs, and contribute to technical discussions with clear reasoning about tradeoffs.
Balance rigor with pragmatism: know when to prototype quickly for learning and when to proceed cautiously due to high costs of error.