Lead Engineer, Cyber Defense Automation

Overview

Lead engineering for cybersecurity response automation, agentic AI SOC workflows, and integrations across the security stack.

What you'll do

• Design and maintain security response automations on an agentic AI SOC platform.
• Lead migration of existing Splunk SOAR playbooks.
• Build agentic workflows with prompts, tools, guardrails, evaluation, and human review.
• Develop Python services and integrations using REST APIs, webhooks, and event-driven patterns.
• Improve case management workflows and operationalize detections into automated response.
• Measure automation throughput, MTTR, false positives, and analyst time saved.
• Write documentation and runbooks for a distributed global team.

What you'll need

• 5+ years in security engineering, security automation, or security-focused software engineering.
• Strong production Python experience.
• Experience with REST APIs, JSON, webhooks, and authentication patterns.
• Hands-on experience with SOAR or security automation platforms.
• Experience building with modern LLM platforms, APIs, SDKs, and tool-use patterns.
• Knowledge of Git, code review, automated testing, and CI/CD.
• Working knowledge of SOC operations, incident response, and MITRE ATT&CK.

Nice to have

• Experience with agentic AI security platforms or production autonomous agent systems.
• LLM fine-tuning, systematic evaluation, or red-teaming experience.
• Splunk Enterprise Security or detection-as-code experience.
• ServiceNow or similar case management experience.
• FastAPI, Flask, AWS, Docker/Kubernetes, or Terraform experience.
• Experience mentoring engineers or leading technical workstreams.

Details

• Hybrid position with at least two days per week at an assigned TU office.
• Location: Bengaluru.