Security Engineer — Detection & Agentic AI

The Agentic SOC Developer is Solidigm's embedded security builder — a Senior Engineer (IC7) who owns detection coverage strategy, builds and ships production agentic detection and response, and directly expands the capability of the SOC and managed-services partner. This role defines and enforces detection standards grounded in MITRE ATT&CK, operationalizes AI agents and automation pipelines, and governs the non-human identity and delegation lifecycle for security AI agents. This is an engineering role, not an analyst role: the person writes and deploys working code in the live environment.

KEY RESPONSIBILITIES

Define and own detection coverage strategy — establish and maintain detection standards, naming conventions, and quality criteria for the SOC. Map the threat landscape to MITRE ATT&CK TTP coverage; prioritize detection development against real adversary behaviors and threat intelligence; track coverage targets, mean-time-to-detect (MTTD), and false positive rates as operational KPIs.

Build and ship agentic detection and response — own the full lifecycle from threat use case through detections-as-code, automated triage, and production agentic response workflows. Ship working code, not designs.

Embed forward-deployed — work alongside the SOC, IR, and platform/engineering teams; deliver directly in their environment; coach MSP analysts and Solidigm engineers on agentic patterns, detection best practices, and operational hygiene. Model IC7 technical leadership: drive decisions, synthesize inputs, and mentor toward measurable growth.

Design and govern AI agent identity and delegation — architect the end-to-end lifecycle for non-human identities operating in the security environment — scoped delegation, audit logging, and kill-switch controls. Own guardrails, safety controls, and human-oversight mechanisms for production security AI agents; apply MITRE ATLAS adversarial ML techniques to threat-model agent deployments.

Architect and evolve the security data platform — own collector/forwarder architecture, log pipeline design, SIEM strategy, and detection-content portability that enable an adaptive, resilient SOC. Contribute to the technical roadmap for security data infrastructure.

Validate through adversary emulation and framework coverage — run or support purple team and adversary emulation exercises to verify detection efficacy systematically; close coverage gaps identified through testing and operational feedback. All detection work is grounded in MITRE ATT&CK (TTP mapping, kill chain coverage, gap analysis). All AI/agent security work is grounded in MITRE ATLAS (adversarial ML, AI-agent attack vectors including v5.4 agent-specific techniques). Operate within and strengthen the NIST AI RMF, OWASP Top 10 for LLM Applications, and OWASP Top 10 for Agentic AI governance gate.

Force-multiply the managed services partner — build supervised automations that expand analyst capacity under oversight — replacing L1 toil with agents and lowering cost-to-serve while maintaining Solidigm governance and visibility.

• B.S. Degree in Information Security, Cybersecurity, Computer Science, Software Engineering, or related fields.
• Advanced English level (mandatory).
• Software development proficiency — Python preferred; API integration; infrastructure-as-code; CI/CD. This is a development role. Expected experience: 4–6+ years of relevant hands-on work.
• Security operations fluency — detection engineering, SIEM/SOAR platforms, and incident response workflows. Comfortable owning the detection lifecycle end-to-end.
• MITRE ATT&CK depth — TTP mapping, kill chain coverage analysis, and detection-to-technique alignment. Ability to build and maintain ATT&CK coverage heatmaps, prioritize detection development against real threat intelligence, and report on TTP coverage gaps and MTTD.
• MITRE ATLAS depth — adversarial ML threat modeling for AI systems and agents — mapping attack techniques such as model evasion, data poisoning, prompt injection, AI supply-chain compromise, and agent-specific vectors (e.g., Publish Poisoned AI Agent Tool, Escape to Host, LLM jailbreaking). Ability to apply ATLAS to threat-model security AI agent deployments and validate guardrails against the framework's technique catalog.
• AI/agent development experience — hands-on building with agent frameworks, RAG pipelines, or agentic orchestration in production.
• AI security governance knowledge — NIST AI RMF; OWASP Top 10 for LLM Applications (LLM01–LLM10: prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, etc.); OWASP Top 10 for Agentic AI Applications; and AI safety control design including guardrails, human oversight mechanisms, and secure orchestration.
• Field mindset — comfortable embedding with operational teams, shipping in partner-controlled environments, and coaching across technical levels.

PREFERRED QUALIFICATIONS

• Microsoft security stack — Defender XDR, Microsoft Sentinel (+ Data Lake), Security Copilot, Logic Apps; KQL; Azure.
• Splunk — SPL, log forwarding, content/detection management, and index administration.
• Agentic tooling — Model Context Protocol (MCP), Security Copilot plugins, or comparable security-native agent orchestration and connector frameworks.
• Non-human identity (NHI) & workload identity — Entra Workload Identities, Okta, or comparable; service principal and managed-identity lifecycle.
• SIEM migration & content portability — platform-to-platform detection migration, collector/forwarder architecture at scale.
• Prior FDE, solutions-engineering, or detection-engineering role — embedded delivery model in enterprise security environments.

Powered by SmartRecruiters - Candidate Privacy Policy