EmergingCyber defence and security operations AI

AI Security Operations Engineer

Also called AI SOC Engineer

An AI Security Operations Engineer builds constrained AI support for security triage and response. It lets a security team move faster on alerts and incidents without handing an agent unchecked authority over live systems.

What they do

They take a real SOC workflow, such as alert triage or phishing response, and design how AI helps at each step. They connect models to security telemetry, the SIEM and case systems through controlled agent tools. They decide which actions an agent may suggest, which it may take, and which need human approval. They build the audit trail so every step can be reviewed. They test the system by attacking it, including prompt injection through alert data. They then watch it in live use, tune it with analysts, and write the runbooks for when it misbehaves.

What a strong hire delivers

In the first months, a strong hire delivers one working SOC workflow with AI support, a clear approval step for any action that changes something, and a full audit trail. Analysts trust it enough to use it. There is a written test set for response quality, a record of red team findings and fixes, and a plain account of what the agent can never do.

How you can tell they are good

Ask them to walk through a workflow they have built or hardened. Strong people explain where the agent's permissions stop and why. They show how they measured response quality, not just speed. They can describe a failure, such as injected instructions in an alert, and what they changed. Be wary of anyone who talks only about model capability and says little about control.

Why it is hard to fill

The work is being done now, but it sits inside titles like detection engineer, SOC automation lead or security engineer. Few people have shipped agents in a live security setting. Candidates tend to be strong in security operations or in AI engineering, rarely both. Security teams also keep this work quiet, so track records are hard to see from a CV or public profile.

Where to find them

Look first in security operations, detection engineering and incident response teams that have already automated parts of triage. SOAR and automation engineers are a natural source. Some come from product security or red teams that moved into AI testing. Security vendors, managed detection providers and large in-house security teams are good places to search. AI platform engineers with security exposure are a smaller pool.

Indicative pay

Not enough published evidence yet to give a fair range for this role, which is common for work this new. We benchmark it for you as part of a search.

Interview questions for an AI Security Operations Engineer

  1. Describe a SOC workflow where you added automation or AI. What did you decide the system could and could not do?

    A strong answer names a specific workflow, the permission boundaries and the reasons for them. It covers which actions needed approval. Worry if everything was automated by default or if limits were set by convenience rather than risk.

  2. How would you stop an agent being manipulated by content inside an alert or email it is triaging?

    Good answers cover treating telemetry as untrusted input, separating instructions from data, limiting tool scope, and testing with adversarial samples. Worry if they rely only on a clever system prompt or say the risk is minor.

4 more questions, with what a strong answer covers, are in the Role Kit.

Job description you can post

We are hiring an AI Security Operations Engineer to build AI support for our security operations team. The goal is faster, better triage and response, with firm limits on what any agent can do. You will work closely with analysts, detection engineers and incident responders.

What you will do

  • Design and build AI-assisted triage and response workflows using our security telemetry, SIEM and case systems
  • Define which actions an agent can suggest, take or must send for human approval
  • Build audit trails that record every input, decision and action
  • Red team our agents, including prompt injection through alert data, and fix what you find
  • Measure response quality against agreed test sets and live review
  • Write runbooks for agent failure and take part in incident response
  • Work with analysts to tune workflows from real use

What you will bring

  • Demonstrated experience in security operations, detection engineering or incident response
  • Built or hardened automation that acts on security data
  • Practical experience with agent orchestration and controlled tool access
  • Understanding of how LLM systems fail or are attacked
  • Able to design evaluation for response quality
  • Clear written communication, including with non-specialists

Nice to have

  • Experience with SOAR or case management automation
  • Prior AI red teaming work
  • Experience writing evidence for audit or compliance review

Free to use and adapt. If it saves you time, a link back to this page is appreciated.

Skills that matter

  • Security engineeringAdvancedProtect systems, identities and sensitive assets
  • AI red teamingAdvancedTest systems adversarially under authorisation
  • Reliability and incident responseWorkingDetect failures, restore service and prevent recurrence
  • Agent orchestrationWorkingCoordinate tool-using agent execution

Other roles in cyber defence and security operations AI

Hiring nowCybersecurity ML ScientistA Cybersecurity ML Scientist builds and tests models that spot malicious activity in authorised security data. They keep detection useful as…Hiring nowAI Detection EngineerAn AI Detection Engineer builds the detections that turn AI-derived signals into alerts a security team can trust. They cut noise, catch real…EmergingDefensive AI Agent EvaluatorA Defensive AI Agent Evaluator tests how AI agents behave inside security detection and response work, and shows where they fail. It matters because…

Related roles in other families

Hiring nowAI Security EngineerAI application security and misuse defenceAn AI Security Engineer hardens the applications, interfaces and sensitive assets built around models. They find how attackers could misuse the…Hiring nowAI Red Team EngineerAI application security and misuse defenceAn AI Red Team Engineer runs authorised attacks against model-connected systems to find weaknesses before real adversaries do. They give the company…Hiring nowAI Abuse Detection AnalystAI application security and misuse defenceAn AI Abuse Detection Analyst spots unauthorised and harmful use of a company's models and products, then turns what they find into rules and cases…EmergingModel Supply Chain Security EngineerAI application security and misuse defenceA Model Supply Chain Security Engineer protects model files, datasets and dependencies from tampering. They give the company confidence that what it…

How we wrote this

Role definitions are our own editorial work, checked against occupational classifications, standards, research and employer pages. Titles vary by company, and this is a description of the work, not a job advert.

← Cyber defence and security operations AIAll new job families

Start a search

Hiring an AI Security Operations Engineer?

Tell us the work. We find the people already doing it, whatever their job title says, and you meet them already interviewed for your role.