Lead Engineer, Cyber Security Counter Threat Management

Royal Caribbean Group; Miami (FL); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Onsite in Miramar

Job summary

Royal Caribbean Group in Miramar, Florida is seeking a Lead Engineer, Cybersecurity Counter Threat Management to architect, build, and operate AI-driven automation that strengthens our security posture at enterprise scale.

You will work at the intersection of AI/ML, security engineering and DevSecOps, owning end-to-end integrations with CrowdStrike, Splunk and ServiceNow while mentoring engineers to reduce MTTR and elevate threat management capabilities.

Qualifications

• 6+ years in software, cybersecurity and/or automation engineering.
• Expert-level Python and/or Node.js for building scalable integrations and automation.
• Proven experience designing with LLM APIs and agentic frameworks in enterprise environments.
• Deep hands-on experience with security platforms (SIEM/SOAR, EDR, firewalls) and their APIs.
• Security certifications (CySA+, CISSP, AWS Security Specialty, OSCP).
• Familiarity with Splunk SPL, KQL, or similar query languages at scale.
• Background in red team, threat hunting, or detection engineering.
• Prior experience in a SOC, MSSP, or enterprise security operations environment.

Responsibilities

• Architect and deploy AI-powered automation workflows for security use cases including threat detection, incident response, vulnerability triage, and compliance monitoring.
• Build and maintain production-grade AI agents and orchestration pipelines that integrate deeply with security tooling (SIEM, EDR, SOAR, firewalls, identity platforms).
• Lead development of LLM-based solutions for log analysis, alert enrichment, and natural language querying of security data.
• Own end-to-end integrations with platforms such as CrowdStrike, Splunk, ServiceNow, and cloud security services.
• Act as a technical SME for SOC analysts and incident responders — identifying high-value automation opportunities, owning delivery, and measuring impact on MTTR.
• Define and enforce standards for AI automation security: least privilege, secrets management, audit logging, and prompt injection controls.
• Evaluate emerging AI models, agentic frameworks, and cybersecurity tooling — translating them into actionable capability roadmap items.
• Mentor junior engineers and provide technical guidance across cross-functional security and engineering teams.

Skills

Python

Node.js

AI/LLM systems

Security analytics

Education

CySA+

CISSP

AWS Security Specialty

OSCP

Tools

SIEM/SOAR

EDR

CrowdStrike

Splunk

ServiceNow

AWS Bedrock

LangChain

KQL

Job description

Journey with us! Combine your career goals and sense of adventure by joining our exciting team of employees. Royal Caribbean Group is pleased to offer a competitive compensation and benefits package, and excellent career development opportunities, each offering unique ways to explore the world.

We are proud to be the vacation-industry leader with global brands — including Royal Caribbean International, Celebrity Cruises and Silversea Cruises — the most innovative fleet and private destinations, and the best people. Together, we are dedicated to turning the vacation of a lifetime into a lifetime of vacations for our guests.

The Royal Caribbean Group’s Global Information Security Team has an exciting career opportunity for a full time Lead Engineer, Cybersecurity Counter Threat Management reporting to the Senior Manager, Cybersecurity Counter Threat Management.

The position is onsite and based in Miramar, Florida. The position is also not eligible for work authorization sponsorship.

Position Summary

We are looking for a seasoned Lead Engineer, Cyber Security Counter Threat Management with a strong technical focus to architect, build, and operate AI-driven automation solutions that enhance our security defense capabilities. You will work at the intersection of AI/ML, security engineering, and DevSecOps to reduce manual work, accelerate threat response, and strengthen our security posture at enterprise scale.

Essential Duties And Responsibilities

• Architect and deploy AI-powered automation workflows for security use cases including threat detection, incident response, vulnerability triage, and compliance monitoring
• Build and maintain production-grade AI agents and orchestration pipelines that integrate deeply with security tooling (SIEM, EDR, SOAR, firewalls, identity platforms)
• Lead development of LLM-based solutions for log analysis, alert enrichment, and natural language querying of security data
• Own end-to-end integrations with platforms such as CrowdStrike, Splunk, ServiceNow, and cloud security services
• Act as a technical SME for SOC analysts and incident responders — identifying high-value automation opportunities, owning delivery, and measuring impact on MTTR
• Define and enforce standards for AI automation security: least privilege, secrets management, audit logging, and prompt injection controls
• Evaluate emerging AI models, agentic frameworks, and cybersecurity tooling — translating them into actionable capability roadmap items
• Mentor junior engineers and provide technical guidance across cross-functional security and engineering teams

Qualifications, Knowledge And Skills

• 6+ years in software, cybersecurity and/or automation engineering; 2+ years working hands-on with AI/LLM systems in production
• Expert-level proficiency in Python and/or Node.js for building scalable integrations and automation
• Proven experience designing with LLM APIs (Anthropic, OpenAI, AWS Bedrock) and agentic frameworks (LangChain, Mastra, CrewAI, or similar) in enterprise environments
• Deep hands-on experience with security platforms (SIEM/SOAR, EDR, firewalls, ticketing) and their APIs
• Strong understanding of REST APIs, MCP servers, event-driven architectures, and message queuing
• Solid grasp of core security domains: MITRE ATT&CK, threat intelligence, IAM, vulnerability management, and incident response lifecycle
• Security certifications (CySA+, CISSP, AWS Security Specialty, OSCP)
• Experience securing AI/LLM systems against prompt injection, model abuse, and data leakageFamiliarity with Splunk SPL, KQL, or similar query languages at scale
• Background in red team, threat hunting, or detection engineering
• Prior experience in a SOC, MSSP, or enterprise security operations environment

Agency and Third-Party Submissions: Please note this is a direct search by the Company, and applications through agencies and other third parties will not be accepted, nor will fees be paid for unsolicited resumes. Any unsolicited resumes will be considered the Company's property.

We know there's a lot to consider. As you go through the application process, our recruiters will be glad to provide guidance, and more relevant details to answer any additional questions. Thank you again for your interest in Royal Caribbean Group. We'll hope to see you onboard soon!

It is the policy of the Company to ensure equal employment and promotion opportunity to qualified candidates without discrimination or harassment on the basis of race, color, religion, sex, age, national origin, disability, sexual orientation, sexuality, gender identity or expression, marital status, or any other characteristic protected by law. Royal Caribbean Group and each of its subsidiaries prohibit and will not tolerate discrimination or harassment.