Manager - Technical Consulting in Cybersecurity Automation and AI Detection Engineering

Role Overview

This position requires an experienced Manager to lead the development and continuous enhancement of next-generation Security Operations capabilities through automation, AI, and detection engineering. The role centers on evolving from traditional SOC analyst procedures to AI-assisted, autonomous security operations, incorporating advanced tools such as SIEM, SOAR, EDR/XDR, AI platforms, and APIs to streamline security workflows and accelerate incident response.

Key Duties

• Lead design and deployment of AI-driven autonomous SOC functions, identifying and automating key security processes including alert triage, investigation, and incident response.
• Develop AI-assisted workflows such as analyst copilots, incident summarization, and threat intelligence analysis utilizing LLM/GenAI technologies.
• Implement security controls including human-in-the-loop approvals and escalation mechanisms for safe AI actions.
• Construct and maintain automated security orchestration playbooks using Python, APIs, SDKs, and scripting, covering alert enrichment, IOC investigation, phishing and malware analysis, containment, and case management.
• Advance detection engineering by developing, tuning, and managing detection rules across multiple security technologies aligned with MITRE ATT&CK, while adopting detection-as-code best practices.
• Integrate diverse security telemetry into AI workflows ensuring data privacy, access control, and auditability.
• Continuously assess SOC processes to improve efficiency and reduce analyst manual effort while measuring operational KPIs.
• Mentor technical staff and collaborate with cross-functional teams to integrate innovative security solutions.

Required Qualifications and Experience

• Over 7 years of cybersecurity experience focused on SOC engineering, detection engineering, security automation, incident response, or SOC operations.
• Proficient hands-on expertise with SIEM platforms such as Microsoft Sentinel, Splunk ES, or Google SecOps.
• Strong experience with SOAR and security orchestration tools alongside development skills using Python and REST APIs.
• In-depth knowledge of SOC workflows and expertise in designing effective security detections and automations.
• Familiarity with MITRE ATT&CK framework and threat-informed defense strategies.
• Experience integrating various security tools including EDR/XDR, identity, email, network, cloud security, and threat intelligence data sources.
• Competence with detection lifecycle management including detection-as-code, version control (Git), CI/CD, and automated testing.
• Practical knowledge of Generative AI and Large Language Models, including AI agents, prompt engineering, AI platforms integration, and secure AI deployment in cybersecurity contexts.

Preferred Technologies

• Microsoft Sentinel, Security Copilot
• Splunk ES, Splunk SOAR
• Cortex XSOAR, XSIAM
• Microsoft Defender XDR
• CrowdStrike, ServiceNow SecOps
• Git, GitLab, GitHub
• Python, REST APIs
• Azure OpenAI, OpenAI APIs or equivalent enterprise LLM platforms
• Cloud security across Azure, AWS, or GCP

Expected Contributions

• Significantly increase automation coverage in SOC operations.
• Decrease manual effort by analysts and reduce false positives in detections.
• Enhance speed and precision of threat investigations and responses.
• Deploy autonomous AI-driven investigation workflows and integrate seamlessly detection and response actions.