Forward Deployed Engineer - AI SOC

Remote; San Francisco (CA); On-site; USD 140,000 - 200,000; Full time

Job summary

Remote is seeking a Forward Deployed Engineer to deploy and operationalize security and AI capabilities in real-world customer environments. This role collaborates with security operations, platform teams, data scientists, and infrastructure stakeholders to implement AI-enabled SOC workflows, integrate tooling, and accelerate time to value.

The ideal candidate blends hands-on engineering with a deep SOC operations understanding, cloud experience, automation, and a customer-facing delivery

Qualifications

• 5+ years in security engineering or platform engineering.
• H hands-on with SIEM, XDR, SOAR and detection engineering.
• Experience deploying cloud-native architectures on AWS, Azure, or GCP.
• Experience interfacing with customers and cross-functional delivery teams.
• Ability to lead technical engagements and deliver on time.

Responsibilities

• Lead deployment of security and AI solutions in customer environments.
• Translate requirements into deployable architectures and plans.
• Collaborate with stakeholders to meet compliance and platform strategy.
• Onboard, implement, roll out, and optimize solutions.
• Design integrations across SIEM, XDR, SOAR, data platforms, and AI tooling.
• Build data ingestion and enrichment pipelines for security telemetry.

Skills

SOC/SECURITY OPERATIONS

Cloud architectures

Automation scripting

APIs and integrations

AI/ML in security

Education

Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience

Tools

Kafka

Kinesis

Pub/Sub

Spark

Databricks

BigQuery

Snowflake

Job description

The Forward Deployed Engineer is responsible for deploying, integrating, and operationalizing next-generation security and AI capabilities in real-world customer and enterprise environments. This role works at the intersection of engineering, security operations, data, and customer success to translate complex requirements into scalable, production-ready solutions.

This individual partners closely with security leaders, analysts, platform teams, data scientists, and infrastructure stakeholders to implement AI-enabled SOC workflows, integrate security tooling, improve analyst experience, and accelerate time to value. The ideal candidate combines strong hands-on engineering skills with a deep understanding of SOC operations, cloud platforms, automation, and customer-facing delivery.

Responsibilities

• Serve as the technical lead for deploying and operationalizing security and AI solutions in customer or enterprise environments

• Translate business, operational, and security requirements into deployable architectures and implementation plans

• Partner with internal and external stakeholders to ensure solutions are aligned to operational goals, compliance requirements, and long-term platform strategy

• Act as a trusted advisor during onboarding, implementation, rollout, and optimization phases

• Design and implement integrations across SIEM, XDR, SOAR, case management, data platforms, and AI-enabled tooling

• Build and configure cloud-native data ingestion, normalization, and enrichment pipelines for security telemetry

• Integrate APIs, webhooks, message queues, and automation workflows across identity, endpoint, cloud, network, and application ecosystems

• Develop reusable deployment patterns, templates, and technical assets to accelerate future implementations

• Operationalize AI and automation use cases within security workflows, including alert enrichment, triage support, summarization, clustering, playbook selection, and analyst copilots

• Work with detection engineering and data teams to support implementation of behavioral analytics, anomaly detection, risk scoring, and other AI-assisted security use cases

• Help define data requirements, feedback loops, and operational guardrails needed to support effective AI outcomes in production environments

• Ensure deployed solutions are practical, measurable, and aligned to analyst workflows and response objectives

• Implement secure and governed automation for investigation and response use cases across heterogeneous environments

• Support resiliency, observability, performance, and scale requirements for deployed solutions

• Troubleshoot integration issues, deployment blockers, and production challenges in partnership with platform, cloud, and security teams

• Improve reliability and maintainability through documentation, testing, monitoring, and standardized engineering practices

• Collaborate across Security Operations, Security Engineering, Detection Engineering, Data Science, Infrastructure, and product or customer teams

• Communicate technical concepts clearly to both technical and non-technical stakeholders

• Mentor engineers and contribute to best practices for implementation, delivery, and technical solution design

• Provide field feedback to influence platform roadmap, product direction, and architectural standards

Required Qualifications

• 5+ years of experience in security engineering, platform engineering, forward deployed engineering, solutions engineering, or related technical roles

• Hands-on experience implementing and operating modern SOC technologies such as SIEM, XDR, and SOAR

• Experience deploying cloud-native architectures on at least one major cloud provider such as AWS, Azure, or GCP

• Strong background in data integration, telemetry pipelines, normalization, and security analytics workflows

• Experience working directly with customers, internal stakeholders, or cross-functional delivery teams in implementation-focused environments

• Ability to lead technical engagements, drive execution, and influence outcomes without direct authority

Technical Skills

• Strong understanding of security operations, detection and response, cloud security, identity security, and endpoint security

• Experience with scripting and automation using tools such as Python, PowerShell, or Bash

• Familiarity with APIs and integration patterns including REST, webhooks, and event-driven workflows

• Working knowledge of AI and ML concepts relevant to SOC use cases, including anomaly detection, behavior analytics, LLMs, vector search, and AI assistants

• Experience with security data and analytics platforms such as Kafka, Kinesis, Pub/Sub, Spark, Databricks, BigQuery, Snowflake, or similar technologies is a plus

• Strong problem-solving skills, execution mindset, and ability to operate effectively in ambiguous, fast-moving environments

Preferred Qualifications

• Experience in MSSP, MDR, XDR, or other security service delivery environments

• Experience deploying solutions in regulated or compliance-sensitive environments

• Familiarity with infrastructure as code, CI/CD workflows, and production software delivery practices

• Experience building reusable implementation frameworks or field engineering playbooks

• Relevant certifications are a plus, including cloud, security, or platform-specific certifications

Education

• Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience