Principal Cybersecurity Automation

This is a fully remote position, open to applicants in Michigan.

📋 Description

• Take ownership of and prioritize the Cyber Defense automation roadmap.

• Design, develop, and manage automation for alert triage, enrichment, containment, case management, and notifications.

• Expand automation efforts in vulnerability management and threat intelligence.

• Create and maintain integrations across endpoint security, detection engineering, security data platforms, asset inventory, threat intelligence, and ticketing systems.

• Identify and implement AI use cases within security operations.

• Design, develop, and operate AI agents and assistants with least privilege, scoped tool access, and human approval for significant actions.

• Develop frameworks for evaluating accuracy, reliability, consistency, and potential failure modes.

• Implement protections against prompt injection, data leakage, and excessive permissions for agents.

• Assess vendor AI capabilities and provide recommendations on whether to build, buy, or wait.

• Utilize version control, peer reviews, automated testing, CI/CD, and change management for automation, detections, prompts, and AI configurations.

• Manage production automation with monitoring, error handling, runbooks, rollback functionalities, and performance oversight.

• Collaborate with Security Architecture, Privacy, Legal, and IT teams on responsible AI governance and risk management.

• Establish engineering standards, reusable patterns, and reference architectures.

• Mentor engineers and analysts.

• Define and report key outcomes such as analyst hours returned, time to triage and containment, automation coverage, reliability, and error rates.

• Simplify complex automation and AI concepts, capabilities, risks, and limitations for both technical teams and executive stakeholders.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field, or an equivalent combination of education and relevant professional experience.

• 8+ years of pertinent experience in cybersecurity, security engineering, software engineering, automation, or related technology fields.

• Proven experience in designing, deploying, and operating production security automation at an enterprise level.

• Strong skills in Python development.

• Proficient in SQL and API integrations, including REST APIs, webhooks, authentication, and OAuth.

• Experience in building and managing production LLM-based solutions, including AI agents, retrieval-augmented generation, prompt design, tool integration, and evaluation.

• Familiarity with implementing controls for security risks specific to AI, including prompt injection, data leakage, excessive agency, and inappropriate access.

• Solid understanding of SOC and incident response operations, detection engineering, and MITRE ATT&CK framework.

• Experience with Git, code reviews, automated testing, CI/CD, observability, and production support.

• Ability to set technical direction and deliver complex solutions across teams through influence rather than direct authority.

• Preferred experience with enterprise SOAR and security automation platforms.

• Hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, Splunk, CrowdStrike, ServiceNow, or similar platforms is preferred.

• Familiarity with Microsoft Azure, Azure AI Foundry, Azure OpenAI, AWS, or similar technologies is preferred.

• Experience in designing agentic AI workflows with human-in-the-loop controls, evaluation frameworks, secure tool usage, and production monitoring is preferred.

• Knowledge of the NIST AI Risk Management Framework and OWASP guidance for LLM and generative AI applications is preferred.

• Relevant cybersecurity, cloud, software engineering, or AI certifications are advantageous.

• Must be legally authorized to work in the U.S. and not require employment-based sponsorship now or in the future.

🏝️ Benefits

• Flexibility to work remotely.

• 10% travel requirement.

• Commitment to equal opportunity employment.

• Transparency in pay and protections during compensation discussions.