Senior SOC Engineer - Agentic

Every SANS employee brings something unique. For this role, we’re looking for candidates with:

• 7+ years in security operations, detection engineering, or security automation, with enough depth to lead engineering efforts independently — and enough intellectual curiosity to be genuinely excited about rebuilding how a SOC works from the ground up.
• First-hand experience with what a well-run SOC looks like — alert triage workflows, escalation paths, investigation patterns, incident response lifecycle.
• Detection engineering experience: writing and tuning detections, measuring efficacy, managing false positives. Expert-level command of at least one detection query language (KQL, SPL, Lucene, Sigma, or equivalent).
• MITRE ATT&CK fluency as a working tool, not a reference.
• Hands-on experience with EDR and SIEM platforms in production environments.
• Ability to design end-to-end security operations pipelines — from log ingestion and detection through enrichment, triage, investigation, and response — with a clear understanding of where automation fits at each stage.
• Systems thinking: comfortable reasoning about data flows, dependencies, failure modes, and the operational implications of architectural decisions before they are built.
• Experience designing for scale and maintainability — architectures that a small team can operate, extend, and recover when things break.
• Exposure to threat modeling concepts applied to security infrastructure — you do not need to have owned this, but you should be ready to grow into it.
• Comfort thinking through architectural tradeoffs and documenting your reasoning — this is a skill we will develop together, not a prerequisite.
• Strong Python — production-quality code with testing, version control, code review discipline.
• Comfortable building integrations against REST APIs across heterogeneous security tools.
• Experience with SOAR platforms, security automation frameworks, or equivalent home-grown tooling.
• Git-based workflows; as-code mindset for detections, automations, and infrastructure.
• Working knowledge of AWS; experience with Azure or GCP is a plus.
• Curiosity about how LLM-based agents differ from traditional automation, and where each fits.
• Willingness to learn agent frameworks, MCP, and prompt engineering on the job, working alongside our AI Engineering team.
• Side projects, reading, courses, or hobby experiments with LLMs or agents are a real plus — not because we need expertise, but because we need engagement.
• Comfortable working with JSON and Markdown — the connective tissue of modern agent tooling, API integrations, MCP server schemas, and documentation.
• Calibrated skepticism about over-automation — willing to say this should be a script, not an agent, or we should not automate this at all.
• Operator empathy. A small security team will live with what you build. If you cannot sit with them and understand the work, you will build the wrong things.
• Comfort with ambiguity. This program is being built, not maintained.
• Unrestricted authorization to work in the USA; visa sponsorship is not available.
• Experience with MSSP-managed detection and response environments.
• Detection-as-code experience: CI/CD pipelines for detection content, automated testing, content packaging.
• Prior experience building SOAR playbooks (Tines, Torq, Cortex XSOAR, Splunk SOAR, or equivalent).
• Incident response experience beyond Tier 1 — you have owned investigations end to end.
• Cloud detection and response experience: audit logging, threat detection services, cloud security posture.
• Identity-focused detection experience (Entra, Okta, Active Directory, or similar).
• Any hands-on experience with LLM tooling: building with LLM APIs, agent frameworks (LangGraph, CrewAI, etc.), or MCP servers — even hobby-level.
• Familiarity with agentic development workflows — CLAUDE.md, Claude Code, GitHub Copilot/Codex, or similar AI-assisted engineering tools.
• Prompt injection and LLM adversarial thinking — particularly relevant since security agents constantly read attacker-controlled data.