Senior Security Engineer - AI Driven SOC Engineer

Rising Tide Digital Inc; Taguig; On-site; PHP 7,561,000 - 11,342,000; Full time

Job summary

Axos Bank seeks a Senior Security Engineer to drive AI-driven incident investigations and threat detection engineering. You will lead complex investigations, design high-fidelity detections, and mentor SOC staff.

The role emphasizes proactive threat hunting, automation, and integrating new data sources into the AI SOC platform. You will participate in a mandatory on-call rotation and collaborate with AI, Security Engineering, and SecOps teams to reduce detection gaps and improve autonomous

Qualifications

• 5+ years of experience in cybersecurity (incident response, threat detection, security engineering, or threat hunting).
• Hands-on experience with SIEMs (Splunk preferred), EDR tools, SOAR platforms, and automation frameworks.
• Ability to write and tune detection rules, correlation logic, saved searches, and behavioral analytics.

Responsibilities

• Lead complex security incident investigations across cloud, identity, endpoint, application, and network layers.
• Design, build, and tune detection logic across security telemetry systems (Splunk, SOAR, cloud).
• Conduct proactive threat hunting using advanced analytics and adversary-emulation techniques.
• Mentor SOC analysts and junior engineers to uplift investigation quality and detection maturity.

Skills

Cloud security

Incident response

Threat detection

SIEM Splunk

EDR tools

SOAR platforms

Python scripting

On-call readiness

Tools

Splunk

SOAR

Job description

The Senior Security Engineer is a key technical leader within Axos Bank’s Security Engineering organization and plays a central role in transforming our traditional Security Operations Center into an AI-driven, investigation-centric threat response function. This role is not a traditional SOC analyst position - it is an engineering-forward role focused on deep incident investigation, advanced threat detection engineering, proactive threat hunting, and enhancing the AI SOC platform so it can autonomously perform higher-quality investigations at scale.

Key Responsibilities

Cybersecurity Incident Investigation

• Lead complex security incident investigations across cloud, identity, endpoint, application, and network layers.
• Perform root‑cause analysis, kill‑chain reconstruction, and evidence preservation with engineering‑grade depth.
• Convert investigation findings directly into new detections, automation playbooks, and AI features to reduce recurrence and detection gaps.
• Participate in a mandatory on‑call rotation, serving as a senior escalation point for complex security incidents - ensuring rapid, high-quality investigative response and feeding lessons learned back into detections, automations, and the AI SOC platform.

Threat Detection Engineering

• Design, build, and tune high‑fidelity detection logic across Splunk, SOAR, cloud platforms, and other security telemetry systems.
• Establish repeatable processes for hypothesis‑driven detection creation, simulation, validation, and tuning.
• Improve detection precision by reducing false positives and strengthening behavioral and contextual analytics.

Proactive Threat Hunting

• Conduct proactive, intelligence‑driven hunts across large datasets using advanced analytics, anomaly detection, and adversary‑emulation techniques.
• Identify unknown threats, emerging attacker behaviors, and gaps in telemetry or tooling.
• Translate hunting insights into durable detections, AI models, automated enrichment, and new investigation workflows.
• Improve the AI SOC platform’s ability to perform autonomous or semi‑autonomous investigations by contributing high‑value signals, features, and decision logic.
• Work closely with AI and Security Engineering leadership to integrate hunting patterns, investigation heuristics, and detection insights into AI pipelines.
• Build feedback loops that allow AI models to learn from analyst investigations and improve over time.
• Create high‑reliability automation workflows that handle triage, enrichment, correlation, and containment actions.
• Collaborate with Detection Engineering and Splunk/automation teams to integrate new data sources, threat‑intelligence feeds, and enrichment pipelines.
• Work closely with SecOps, Cloud, AppSec, Detection Engineering, and AI Engineering teams to strengthen detection coverage and reduce operational friction.
• Produce high‑quality documentation, playbooks, knowledge articles, and engineering runbooks.
• Mentor SOC analysts, junior engineers, and cross‑team partners to uplift investigation quality and detection maturity.

Required Qualifications

• 5+ years of experience in cybersecurity (incident response, threat detection, security engineering, or threat hunting).
• Strong technical expertise in cloud security, identity security, endpoint telemetry, network analysis, or application security.
• Proven ability to perform deep‑dive incident investigations involving cloud IAM, lateral movement, privilege escalation, API abuse, malware, or application‑layer threats.
• Hands‑on experience with SIEMs (Splunk preferred), EDR tools, SOAR platforms, and automation frameworks.
• Ability to write and tune detection rules, correlation logic, saved searches, and behavioral analytics.
• Strong scripting ability (Python preferred) and familiarity with data analysis techniques.
• Willingness and ability to participate in a mandatory on‑call rotation and act as a senior escalation point during high‑severity incidents.

Preferred Qualifications

• Experience partnering with AI/ML engineering teams or contributing to AI‑assisted security tooling.
• Background in threat intelligence, malware analysis, or offensive security (red team, adversary emulation).
• Knowledge of cloud‑native detection patterns (AWS, Azure), identity‑based attacks, and API security.
• Certifications such as GCIH, GCDA, GDAT, GCTI, GCFA, or equivalent are a plus.