AI Security Automation Engineer - Claude and Splunk

The Judge Group; Texas; On-site; USD 150,000 - 210,000; Full time

Job summary

The Judge Group is seeking an experienced AI Security Automation Engineer to design, build, and deploy an AI-powered alert triage and investigation platform using Claude and Splunk. This role moves from concept to production, leveraging AI agents to analyze security alerts, gather evidence, and produce structured investigation outcomes.

You will develop agent workflows on Claude, integrate with Splunk, create evaluation frameworks, and run shadow deployments to validate performance.

Qualifications

• Hands-on experience with Claude Messages API, tool calling, and multi-step agent workflows.
• Experience building AI agents using the Claude Agent SDK or comparable orchestration frameworks.
• Experience with Model Context Protocol (MCP) and exposing external systems as agent tools.
• Strong prompt engineering skills focused on structured outputs and automated decision-making.

Responsibilities

• Design and build AI agent workflows on the Claude platform to automate alert triage and investigations.
• Integrate AI agents with Splunk and enrichment sources using secure, read-only tools.
• Develop structured outputs including verdicts, confidence scores, supporting evidence, and recommended next actions.
• Create evaluation frameworks using historical alert data and analyst dispositions.
• Run and optimize shadow-mode deployments alongside security analysts to validate performance.
• Continuously refine prompts, tools, and workflows to achieve agreed-upon accuracy and false-negative thresholds.
• Deploy and operate the solution in production with secure architecture and secrets management, CI/CD and infrastructure automation, monitoring, tracing, logging, and observability.

Skills

AI security

Claude platform

Agent workflows

CI/CD

Observability

Cost optimization

Tools

Claude Messages API

Splunk

Agent SDK

MCP

Job description

We are seeking an experienced AI Security Automation Engineer to design, build, and deploy an AI-powered alert triage and investigation platform using the Claude ecosystem and Splunk. This individual will take the solution from concept through production, leveraging AI agents to analyze security alerts, gather evidence, and produce structured investigation outcomes.

This is a highly technical engineering role focused on agent development, AI orchestration, evaluation frameworks, and production-scale deployment. Security domain expertise will be provided by our internal team, so deep SOC experience is not required.

What You'll Do

• Design and build AI agent workflows on the Claude platform to automate alert triage and investigations.
• Integrate AI agents with Splunk and enrichment sources using secure, read-only tools.
• Develop structured outputs including verdicts, confidence scores, supporting evidence, and recommended next actions.
• Create evaluation frameworks using historical alert data and analyst dispositions.
• Run and optimize shadow-mode deployments alongside security analysts to validate performance.
• Continuously refine prompts, tools, and workflows to achieve agreed-upon accuracy and false-negative thresholds.
• Deploy and operate the solution in production with:
• Secure architecture and secrets management
• CI/CD and infrastructure automation
• Monitoring, tracing, logging, and observability
• Cost, latency, and reliability management
• Prompt injection and security safeguards
• Deliver architecture documentation, runbooks, datasets, prompts, and knowledge transfer to internal teams.

Claude Platform & Agent Engineering

• Hands-on experience with Claude Messages API, tool calling, and multi-step agent workflows.
• Experience building AI agents using the Claude Agent SDK or comparable orchestration frameworks.
• Experience with Model Context Protocol (MCP) and exposing external systems as agent tools.
• Strong prompt engineering skills focused on structured outputs and automated decision-making.
• Expertise in optimizing AI systems for:
• Cost efficiency
• Model tiering and routing
• Prompt caching
• Recent experience working with current Anthropic models and agent capabilities.

Software & Production Engineering

• Experience building asynchronous, event-driven, or queue-based architectures.
• Knowledge of idempotent processing and resilient retry patterns.
• Cloud deployment experience including CI/CD, Infrastructure as Code, and secrets management.
• Experience managing API rate limits, fault tolerance, and service reliability.
• Strong observability experience including:
• Distributed tracing
• Pay rate could be
• Logging of prompts, tool calls, and outputs
• Monitoring dashboards and operational metrics