Hiring nowCyber defence and security operations AI

AI Detection Engineer

Also called AI SOC Detection Engineer

An AI Detection Engineer builds the detections that turn AI-derived signals into alerts a security team can trust. They cut noise, catch real threats and keep analysts working on what matters.

What they do

They write and tune detection rules and models that use AI signals alongside conventional security telemetry. They work in the SIEM and case systems the analysts already use. They test each detection against real and simulated activity, then check how the alerts behave when triaged. They review false positives with analysts, adjust logic and record why. They also set up controlled agent tools that help with triage, with clear limits on what those tools can touch. When a detection fails or an AI component drifts, they investigate and fix it.

What a strong hire delivers

In the first months, a strong hire ships a small set of detections that analysts actually use. They set up a way to validate triage outcomes, so quality is measured and not guessed. They bring the false-positive burden down to something the team can manage. They document how each detection works, who owns it and how to retire it. They also flag where AI signals are too weak to trust.

How you can tell they are good

Ask them to walk through a detection they built, from the idea to the tuned result. Strong people explain what they measured, what they got wrong and what they removed. Ask how they would test an AI signal against evasion. Be wary of anyone who talks only about model accuracy and never about analyst workload, alert fatigue or ownership after launch.

Why it is hard to fill

Few people sit across both detection engineering and applied AI. Titles vary, and many good candidates are called analysts, threat hunters or security engineers. Others come from machine learning and lack operational security instincts. We see companies hold out for a perfect match and stall. The better route is a strong detection engineer with real curiosity about AI, or the reverse with proven security work.

Where to find them

Most come from security operations centres, detection engineering teams and incident response. Some move over from threat hunting, security engineering or security data science. Look at managed detection providers, large in-house security teams, cloud and platform companies, and security software firms. A smaller group comes from AI red teaming and agent safety work, and brings useful adversarial thinking.

Indicative pay

Not enough published evidence yet to give a fair range for this role, which is common for work this new. We benchmark it for you as part of a search.

Interview questions for an AI Detection Engineer

  1. Tell me about a detection you built that analysts relied on. How did you know it was working?

    A strong answer names the threat, the data used and the measures of success, such as analyst feedback and false-positive review. It covers tuning over time. Worry if they only cite design and never describe outcomes.

  2. How would you add an AI-generated signal to an existing alerting pipeline without flooding the team?

    They should describe testing the signal offline first, running it alongside existing alerts, setting thresholds and agreeing a review loop with analysts. Worry if they plan a direct switch-on or treat the signal as ground truth.

4 more questions, with what a strong answer covers, are in the Role Kit.

Job description you can post

We are hiring an AI Detection Engineer to help our security team turn AI signals into alerts people can trust. You will work with analysts and engineers on detections that find real threats without burying the team in noise. The work is done within authorised security workflows.

What you will do

  • Build and tune detection rules and models that use AI signals with security telemetry
  • Validate detections against real and simulated activity
  • Review triage outcomes with analysts and reduce false positives
  • Set up controlled agent tools for triage with clear limits
  • Monitor detection health and investigate failures or drift
  • Document each detection, its owner and its retirement criteria

What you will bring

  • Demonstrated detection engineering, security operations or incident response work
  • Experience writing and tuning detections in a SIEM
  • Ability to measure detection quality and explain the results
  • Working knowledge of how AI systems fail or can be evaded
  • Experience with case systems and analyst workflows
  • Clear written communication with technical and non-technical colleagues

Nice to have

  • Experience with AI red teaming
  • Experience building or governing agent tools
  • Background in security data science

Free to use and adapt. If it saves you time, a link back to this page is appreciated.

Skills that matter

  • Security engineeringAdvancedProtect systems, identities and sensitive assets
  • AI red teamingAdvancedTest systems adversarially under authorisation
  • Reliability and incident responseWorkingDetect failures, restore service and prevent recurrence
  • Agent orchestrationWorkingCoordinate tool-using agent execution

Other roles in cyber defence and security operations AI

Hiring nowCybersecurity ML ScientistA Cybersecurity ML Scientist builds and tests models that spot malicious activity in authorised security data. They keep detection useful as…EmergingAI Security Operations EngineerAn AI Security Operations Engineer builds constrained AI support for security triage and response. It lets a security team move faster on alerts and…EmergingDefensive AI Agent EvaluatorA Defensive AI Agent Evaluator tests how AI agents behave inside security detection and response work, and shows where they fail. It matters because…

Related roles in other families

Hiring nowAI Security EngineerAI application security and misuse defenceAn AI Security Engineer hardens the applications, interfaces and sensitive assets built around models. They find how attackers could misuse the…Hiring nowAI Red Team EngineerAI application security and misuse defenceAn AI Red Team Engineer runs authorised attacks against model-connected systems to find weaknesses before real adversaries do. They give the company…Hiring nowAI Abuse Detection AnalystAI application security and misuse defenceAn AI Abuse Detection Analyst spots unauthorised and harmful use of a company's models and products, then turns what they find into rules and cases…EmergingModel Supply Chain Security EngineerAI application security and misuse defenceA Model Supply Chain Security Engineer protects model files, datasets and dependencies from tampering. They give the company confidence that what it…

How we wrote this

Role definitions are our own editorial work, checked against occupational classifications, standards, research and employer pages. Titles vary by company, and this is a description of the work, not a job advert.

← Cyber defence and security operations AIAll new job families

Start a search

Hiring an AI Detection Engineer?

Tell us the work. We find the people already doing it, whatever their job title says, and you meet them already interviewed for your role.