AI-Driven Cyber Defense Engineer (Remote UK)

BeyondTrust, Inc.; United States; Remote; USD 87,000 - 134,000; Full time

Benefits offered by this job

Bupa healthcare

Parental leave

Employee Assistance Programme

Learning budgets

AI skills development

Holiday entitlement 25 days

Annual bonus up to 10%

Pension plan

Job summary

BeyondTrust is seeking a Security Operations Engineer to defend enterprise infrastructure and a widely deployed privileged access management product used by thousands of organizations. You will monitor, investigate, and respond to security events within a Cyber Defense Operations team.

You will design and tune detection rules, translate threat intel into content, and contribute to AI-driven triage and investigation workflows.

Qualifications

• Hands-on experience in security operations or incident response across SIEM, EDR, and cloud-native log sources.
• Strong analytical thinking with the ability to produce clear, decision-ready incident documentation.
• Scripting and automation skills in Python, PowerShell, or equivalent applied to security workflows.
• Familiarity with identity and access management platforms and cloud security posture management tools.

Responsibilities

• Triage and investigate alerts across SIEM, EDR, and CSPM platforms covering corporate and product environments.
• Participate in or lead incident response from detection through remediation, including forensic analysis, evidence handling, and post-incident reporting.
• Design, tune, and maintain detection rules mapped to MITRE ATT&CK, reducing false positives and closing coverage gaps.
• Translate threat intelligence from CVE advisories, CISA alerts, and vendor bulletins into actionable detection content.
• Use and help shape AI-driven tools for triage, enrichment, and investigation workflows.
• Collaborate with threat hunting peers to validate detection logic through hypothesis-driven hunts.

Skills

Security operations

Incident response

Python

PowerShell

AI-driven workflows

IAM platforms

Cloud security posture management

Tools

SIEM

EDR

CSPM

Job description

BeyondTrust is seeking a Security Operations Engineer to defend enterprise infrastructure and a widely deployed privileged access management product used by thousands of organizations. You will monitor, investigate, and respond to security events within a Cyber Defense Operations team.

You will design and tune detection rules, translate threat intel into content, and contribute to AI-driven triage and investigation workflows.