Senior Security Application Engineer - Automation & Detection

PVH (Tommy Hilfiger/Calvin Klein); Región Centro; Presencial; MXN 2.099.370 - 3.149.055; Jornada completa

Descripción de la vacante

Solidigm seeks an Agentic Detection & Response Engineer to lead end-to-end security initiatives, shaping detection standards, mapping threat landscapes to MITRE ATT&CK, and owning detections-as-code and production workflows.

This role requires 4–6+ years of hands-on security engineering, Python, and experience with SIEM/SOAR; you will collaborate with firmware, CI/CD, and product teams to implement attestation and governance across devices.

Formación

• 4–6+ years of hands-on security engineering experience.
• Experience integrating security controls into firmware and CI/CD pipelines.
• Familiarity with MITRE ATT&CK and OWASP Top 10 for AI/LAA applications.

Responsabilidades

• Define and own detection coverage strategy and quality criteria.
• Map threat landscape to ATT&CK coverage and monitor KPIs such as MTTD and FP rates.
• Develop and ship agentic detection and response workflows.
• Architect AI agent identity, delegation, and kill-switch controls.
• Apply ATLAS adversarial ML techniques and validate guardrails against OWASP Top 10.
• Lead security integration across hardware, firmware, and product teams.

Conocimientos

Threat modeling

Security engineering

Mentoring teammates

Herramientas

Splunk

Microsoft Sentinel

Python

ATT&CK mapping

Descripción del empleo

Agentic Detection & Response Engineering

• Define and own detection coverage strategy – establish detection standards, naming conventions, and quality criteria for the SOC and Product Security program.
• Map the threat landscape to MITRE ATT&CK TTP coverage; prioritize detection development against real adversary behaviors and threat intelligence; maintain ATT&CK coverage heatmaps and track MTTD and false positive rates as operational KPIs.
• Build and ship agentic detection and response – own the full lifecycle from threat use case through detections-as-code, automated triage, and production agentic response workflows.
• Design and govern AI agent identity and delegation – architect the end-to-end lifecycle for non-human identities operating in the security environment, including scoped delegation, audit logging, and kill‑switch controls.
• Apply MITRE ATLAS adversarial ML techniques to threat‑model all agent deployments; validate guardrails against OWASP Top 10 for LLM Applications and OWASP Top 10 for Agentic AI.

Product Security & Cryptographic Infrastructure

• Support and enhance Solidigm's Product Security & Code Signing platform – the cryptographic foundation for firmware signing, device identity (EJBCA/PKI), attestation (COSE/CBOR, LMS, PQC/ML-DSA), and unlock (CRAM/ADU) across all product lines.
• Build and maintain automation for signing pipelines, HSM health monitoring, certificate lifecycle management, and access provisioning workflows integrated into CI/CD.
• Contribute to PQC adoption – ML-DSA, LMS/LMOD, CNSA 2.0+, and OCP 3.0+ readiness – by developing and shipping the automation and tooling that operationalizes these standards.
• Own and evolve the security data platform supporting cryptographic governance: signing telemetry, KPI dashboards, audit logging, and anomaly detection for signing infrastructure.
• Architect and govern AI agent integrations within the code signing and cryptographic operations environment – scoped identity, delegation controls, and human‑oversight mechanisms for any automation touching signing or key operations.

Application & Product Security Integration

• Embed across firmware engineering, CI/CD, and manufacturing teams – delivering security controls, pipeline integrations, and attestation automation directly in their environments.
• Integrate security requirements (SAST, SBOM generation and validation, attestation signing, supply‑chain controls) across firmware build and release pipelines.
• Validate security controls through adversary emulation and purple team exercises; close coverage gaps identified through testing and operational feedback.
• Operate within and strengthen NIST AI RMF, OWASP Top 10 for LLM Applications, NIST FIPS 140‑3, NSA CNSA 2.0+, OCP 2.5 to 3.0+, and ISO 27001/SOX ITGC governance gates.

Technical Leadership & Expectations

• Lead security program components and define detection, automation, and cryptographic governance standards – not just execute them.
• Shape the product and application security engineering roadmap through threat modeling, control design, and input to the Cryptographic Architecture Board and security roadmap.
• Serve as initial point of contact for cross‑team security engineering projects; align technical outcomes with business requirements across firmware, manufacturing, and operations.
• Mentor MSP analysts, junior security engineers, and firmware engineers on agentic patterns, detection best practices, and cryptographic operational hygiene – multiplying team effectiveness.
• Champion good engineering habits (TDD, security‑by‑design, tech debt balance, agile) within and beyond the security team; uphold standards that set a benchmark for excellence.
• Work with Engineering Managers and the Product & App Security Lead to define priorities, roadmap, and resource allocation; be accountable for high quality in team output.

Force‑Multiply Managed Services & Operational Partners

• Build supervised automations that expand analyst and operator capacity under oversight – replacing L1 toil with agents and lowering cost‑to‑serve while maintaining Solidigm governance and visibility.
• Develop and maintain operational runbooks, training materials, and knowledge documentation to build resilient team capabilities and reduce single‑person knowledge concentration risk.
• Participate in daily, weekly, and monthly governance rhythms: ops standups, KPI reporting, quarterly CISO reviews, and the Cryptographic Architecture Board.
• Software development proficiency – Python preferred; API integration; infrastructure‑as‑code; CI/CD pipeline development. This is a development role. Expected experience: 4‑6+ years of relevant hands‑on work.
• Security engineering depth – detection engineering, SIEM/SOAR platforms (Microsoft Sentinel and/or Splunk), and incident response workflows. Comfortable owning the detection lifecycle end‑to‑end.
• MITRE ATT&CK depth – TTP mapping, kill chain coverage analysis, and detection‑to‑technique alignment; ability to build and maintain ATT&CK c