Security Technical Lead - AI SOC

AHEAD, United States

The role

The Security Technical Lead – AI SOC is a production security engineer who works embedded with customer security and engineering teams to make security operations more effective, measurable, and resilient. This role owns outcomes across assessment, design, build, deployment, optimization, and operational handoff.

What you need

Required Qualifications

5+ years of experience in security engineering, security operations, detection and response, cloud security, platform security, solutions engineering, forward-deployed engineering, or related technical roles.
Demonstrated depth in at least one cybersecurity discipline, such as application security, SecOps or detection engineering, cloud security, IAM, offensive security, or GRC.
Hands-on experience implementing or operating modern SOC technologies such as SIEM, XDR, SOAR, case management, security analytics, or threat intelligence platforms.
Experience owning end-to-end security delivery in a customer-embedded, production, consulting, managed-services, or implementation environment.
Experience deploying or integrating cloud-native architectures on AWS, Azure, GCP, or another major cloud platform.
Strong understanding of security operations, incident response, detection engineering, threat hunting, cloud security, identity security, endpoint security, and security automation.
Experience with security telemetry, data integration, normalization, enrichment, event correlation, and analytics workflows.
Experience developing and managing detections through their full lifecycle, including use-case definition, rule or query development, testing, tuning, deployment, validation, documentation, and retirement.
Experience managing security data sources, including parsers, schema mapping, normalization, enrichment, routing, retention, access controls, and data-quality monitoring.
Experience with scripting and automation using Python, PowerShell, Bash, or a similar language.
Familiarity with APIs and integration patterns including REST, webhooks, event-driven workflows, and message queues.
Demonstrated experience applying AI, machine learning, LLMs, or AI-assisted development to practical security use cases. Theoretical familiarity alone is not sufficient.
Working knowledge of AI security risks and controls relevant to LLM, RAG, agentic, or AI-enabled security workflows.
Ability to lead technical engagements, own outcomes, drive execution, and influence without direct authority.
Proven ability to communicate technical security risk clearly to both technical and non-technical stakeholders.
Strong problem-solving skills, structured analytical thinking, and the ability to operate effectively in ambiguous, fast-moving environments.

Technical Skills

Security operations: SIEM, XDR, SOAR, incident response, detection engineering, threat intelligence, threat hunting, case management, and security analytics.
Detection engineering: detection use-case development, rule and query languages, correlation logic, Sigma or platform-native content, MITRE ATT&CK mapping, detection-as-code, testing, tuning, and coverage validation.
SIEM and security data management: parsing, schema mapping, normalization, enrichment, data-quality monitoring, ingestion health, routing, retention, access controls, and cost/performance optimization.
Cloud and infrastructure security: AWS, Azure, GCP, IAM, network security, endpoint security, secrets management, container security, and cloud posture management.
Security engineering: threat modeling, secure-by-design principles, vulnerability management, security controls, logging and monitoring, production hardening, and incident response.
Automation and integration: Python, PowerShell, Bash, REST APIs, webhooks, event-driven architectures, message queues, CI/CD, infrastructure as code, and policy as code.
AI security: LLM and agentic architectures, RAG, embeddings, vector databases, inference services, AI application security, prompt injection, data protection, guardrails, model and data supply-chain risks, and runtime monitoring.
Security data and analytics platforms such as Kafka, Kinesis, Pub/Sub, Spark, Databricks, BigQuery, Snowflake, or similar technologies are a plus.

Education

Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience

The compensation range indicated in this posting reflects the On-Target Earnings (“OTE”) for this role, which includes a base salary and any applicable target bonus amount. This OTE range may vary based on the candidate’s relevant experience, qualifications, and geographic location.

Why AHEAD

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

USA Employment Benefits include

Medical, Dental, and Vision Insurance
401(k)
Paid company holidays
Paid time off
Paid parental and caregiver leave
Plus more! See benefits https://www.aheadbenefits.com/ for additional details.

Use of AI

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, assessing responses, or to capture recordings and create transcriptions or summaries during interviews. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please refer to the Candidate Privacy Notice or contact us at privacy@ahead.com.

You may opt-out of the review or analysis of your application and resume by AI tools by using the General Application. Please include the role you wish to apply for in the Additional Information field. You may also choose to opt-out of recording and transcription at any time, including after joining an interview. Candidates will not be penalized for choosing to opt-out.

Security Operations, Detection, and Response

Design and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.
Build and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.
Partner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.
Define, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.
Translate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.
Validate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort.
Establish detection-as-code practices, including version control, peer review, documentation, testing, change management, and promotion across environments.
Own SIEM and security-data management across, schema mapping, parsing, normalization, enrichment, routing, retention, access controls, and cost/performance optimization.
Define telemetry requirements and data-quality controls; monitor ingestion health, freshness, completeness, duplication, parsing failures, and coverage across identity, endpoint, cloud, network, SaaS, application, and AI sources.
Develop and operationalize playbooks and automated workflows for investigation, containment, enrichment, escalation, and response.
Build security tooling and detection systems that improve signal quality, reduce analyst burden, and accelerate time to response.
Support behavioral analytics, anomaly detection, correlation, risk scoring, and other security analytics use cases.
Define and track practical measures of security improvement, including detection coverage, response efficiency, automation coverage, false-positive reduction, and risk reduction.
Troubleshoot integration issues, deployment blockers, data-quality problems, and production incidents in partnership with security, cloud, platform, and infrastructure teams.

Security Technical Lead - AI SOC

The role

Security Technical Lead - AI SOC

The role

What you need

Required Qualifications

Technical Skills

Education

Why AHEAD

USA Employment Benefits include

Use of AI

Nice to have

Embedded Security Engineering and Delivery

Security Operations, Detection, and Response

Secure AI and AI-Enabled Security Operations

Cloud, Platform, and Automation Engineering

Cross-Functional Leadership and Practice Development

About AHEAD

Similar jobs at other companies

Principal AI Security Engineer

Principal Security Engineer - AI

Security Engineer - Member of Technical Staff

Senior AI Information Security Engineer

Senior AI Engineer, Security Infrastructure

Security Engineer, AI

Interview questions

AHEAD

Compared with similar jobs