Cyber AI Engineer

EY; India; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

EY in India is seeking a Senior Cybersecurity Engineer to design agentic AI-driven SOC architectures integrated with SIEM/XDR/SOAR, enhancing threat detection and automated response. The role blends hands-on engineering with client delivery and requires building AI use cases, playbooks, and documentation.

The ideal candidate will have 4–7 years in cybersecurity, experience with major platforms, and strong knowledge of MITRE ATT&CK, automation, and AI-assisted workflows.

Qualifications

• 4–7 years in Cybersecurity / SOC Engineering / Detection & Response.
• Experience with platforms such as Microsoft Sentinel, Defender XDR, CrowdStrike, or Splunk.
• Strong understanding of SIEM, SOAR, XDR/EDR, and detection engineering.
• Exposure to AI/ML or LLM use cases in SOC environments.
• Experience with automation (playbooks, APIs, scripting).
• Familiarity with prompt engineering or AI-assisted workflows.
• Knowledge of MITRE ATT&CK and incident response lifecycle.

Responsibilities

• Design and implement agentic AI-driven SOC architectures integrated with SIEM, XDR, and SOAR.
• Develop AI use cases for alert triage, investigation, incident summarization, and automated response.
• Build and optimize detection use cases using rule-based and AI-assisted approaches.
• Integrate LLM capabilities into SOC workflows (analysis, correlation, playbooks).
• Support platform deployment, migration, and tuning across SIEM/XDR environments.
• Improve SOC efficiency through automation, noise reduction, and prioritization.
• Operationalize threat intelligence into detection pipelines.
• Collaborate with clients on solution design and implementation.
• Create architecture diagrams, playbooks, and technical documentation.
• Contribute to AI-driven SOC capability building.

Skills

Cybersecurity expertise

SOC engineering

SIEM/XDR/SOAR

AI/ML in SOC

Automation scripting

MITRE ATT&CK

Client communication

Job description

Job Title: GDS Cyber - Frontier AI Layered Defense Detection and Response - Senior

Senior Cybersecurity Engineer Agentic AI & SOC Engineering (4–7 Years)

Role Overview

As a Senior Cybersecurity Engineer, you will help build next-generation SOC solutions by combining SIEM/XDR/SOAR with AI/LLM-driven automation. The role focuses on designing agent-based AI systems to enhance threat detection, automate investigations, and orchestrate response actions, while engaging in both hands-on engineering and client delivery.

Key Responsibilities

• Design and implement agentic AI-driven SOC architectures integrated with SIEM, XDR, and SOAR
• Develop AI use cases for alert triage, investigation, incident summarization, and automated response
• Build and optimize detection use cases using rule-based and AI-assisted approaches
• Integrate LLM capabilities into SOC workflows (analysis, correlation, playbooks)
• Support platform deployment, migration, and tuning across SIEM/XDR environments
• Improve SOC efficiency through automation, noise reduction, and prioritization
• Operationalize threat intelligence into detection pipelines
• Collaborate with clients on solution design and implementation
• Create architecture diagrams, playbooks, and technical documentation
• Contribute to AI-driven SOC capability building

Required Skills & Experience

• 4–7 years in Cybersecurity / SOC Engineering / Detection & Response
• Experience with platforms such as Microsoft Sentinel, Defender XDR, CrowdStrike, or Splunk
• Strong understanding of SIEM, SOAR, XDR/EDR, and detection engineering
• Exposure to AI/ML or LLM use cases in SOC environments
• Experience with automation (playbooks, APIs, scripting)
• Familiarity with prompt engineering or AI-assisted workflows
• Knowledge of MITRE ATT&CK and incident response lifecycle
• Strong problem-solving and client communication skills

Preferred Skills

• Experience with agentic AI frameworks (LangChain, Semantic Kernel, AutoGen, etc.)
• Exposure to Azure AI / OpenAI platforms
• Understanding of RAG, embeddings, or semantic search
• Experience integrating AI into SOC use cases (correlation, copilots, auto-remediation)
• Knowledge of cloud security / DevSecOps