AI SOC Engineer: Architect the Security Brain with LLMs

ByLabs; San Francisco (CA); On-site; USD 140,000 - 210,000; Full time

Job summary

ByLabs is seeking an AI SOC Engineer who blends offensive/defensive security with hands-on AI engineering to build a Security Brain that uses LLMs and AI agents to automate rule generation, reduce alert noise, and run automated security operations.

You will design AI-driven triage, integrate threat intel, ATT&CK mappings, and SIEM/EDR/NDR detections, and prototype AI SOC products to stay ahead of AI-powered adversaries.

Qualifications

• 3+ years of SOC/security operations or pentesting experience.
• Familiar with MITRE ATT&CK framework and mapping TTPs to detections.
• Hands-on experience building AI-assisted security tooling.

Responsibilities

• Automate generation, testing, and optimization of detection rules using LLMs and AI tools.
• Design AI-based alert triage, prioritization, and false-positive suppression models.
• Architect a unified knowledge graph integrating threat intel, attack graphs, and context.
• Research and deploy AI SOC platform capabilities: automated threat hunting and AI-assisted investigations.
• Develop detection scenarios from attacker perspective covering real-world TTPs.
• Track AI SOC frontier research and drive internal adoption.

Skills

SOC operations

SIEM platforms

Python

LLM integration

Threat hunting

MITRE ATT&CK

Tools

Splunk

Elastic

SPL

KQL

Sigma

LangChain

AutoGen

Job description

ByLabs is seeking an AI SOC Engineer who blends offensive/defensive security with hands-on AI engineering to build a Security Brain that uses LLMs and AI agents to automate rule generation, reduce alert noise, and run automated security operations.

You will design AI-driven triage, integrate threat intel, ATT&CK mappings, and SIEM/EDR/NDR detections, and prototype AI SOC products to stay ahead of AI-powered adversaries.