Platform Security Automation Engineer

TENEX.AI; San Jose (CA); Hybrid; USD 150,000 - 210,000; Full time

Job summary

TENEX.AI in the United States is seeking a Platform Security Automation Engineer to join our security engineering team. You will own the integration layer between AI agents and security platforms, deploy SIEM/SOAR/EDR environments, and build production-grade Python services with robust APIs and tooling.

The role requires hands-on experience across multiple platforms, strong vendor API integration, and designing safe automated response workflows.

Qualifications

• Deep hands-on experience operating multiple SIEM/SOAR/EDR platforms.
• Production-grade Python services and APIs development experience.
• Experience integrating with complex vendor APIs with auth, rate limits, and retries.
• Experience designing automated detection/response workflows with safety guardrails.
• Track record of end-to-end production ownership of a platform.

Responsibilities

• Operate security platforms across multiple vendors (SIEM/SOAR/EDR) and manage policies and connectors.
• Troubleshoot EDR agent issues, performance impacts, and false positives.
• Develop, test, and deploy production Python services and APIs with CI/CD and containers.
• Build automated containment and remediation workflows with safe rollback paths.
• Architect guardrails for automated actions including approvals and rate limits.
• Own platform reliability, latency outcomes, and participate in on-call rotations.
• Create internal tooling with observable logging and metrics.

Skills

SIEM/SOAR/EDR operations

Production Python services

Vendor API integration

Security tooling in production

End-to-end platform ownership

Education

Bachelor's or Master's in CS/Engineering

Certifications (AWS/GCP, Kubernetes)

Tools

CrowdStrike

Splunk

Microsoft Defender

Google Cloud / Google SecOps

Job description

Company Overview:

TENEX is an AI-native, automation-first, built-for-scale Managed Detection and Response (MDR) provider. We are a force multiplier for defenders, helping organizations enhance their cybersecurity posture through advanced threat detection, rapid response, and continuous protection. Our team is composed of industry experts with deep experience in cybersecurity, automation and AI-driven solutions. Backed by leading investors, we are rapidly growing and seeking top talent to join our mission of revolutionizing the AI-Native MDR landscape.

We’re a fast growing startup backed by industry experts and top tier investors led by Crosspoint Capital Partners and also backed by Shield Capital, DTCP (formerly Deutsche Telekom Capital Partners), Deepwork Capital, and the Florida Opportunity Fund. Seed round led by Andreessen Horowitz (a16z). As an early employee, you’ll play a meaningful role in defining and building our culture. Get in on the ground floor. We’re a small but well‑funded team that just raised a substantial round – joining now comes with limited risk and unlimited upside.

Culture is one of the most important things at TENEX.AI - explore our culture deck at culture.tenex.ai to witness how we embody it, prioritizing the irreplaceable collaboration and community of in‑person work.

Reporting to Software Engineering, the Platform Security Automation Engineer owns the integration layer between our AI agents and the security platforms they work with. You will deploy and maintain SIEM, SOAR, and EDR environments across a wide range of vendors, and build the software, automated response workflows, and internal tooling that connect them.

Location: San Jose, CA, Sarasota, FL or Overland Park, KS. We will require 4 days onsite M-TH.

You will:

• Operate security platforms across vendors: Deploy, configure, and maintain sandboxes of SIEM, SOAR, and EDR environments across vendors such as CrowdStrike, SentinelOne, Microsoft Defender, Splunk, Microsoft Sentinel, and Google SecOps. Manage prevention policies, host groups, custom IOAs, and exclusions on EDR platforms, detection content on SIEM platforms, and connectors on SOAR platforms.

• Resolve platform issues: Troubleshoot and resolve EDR agent problems across our environments, managing performance impacts, kernel or driver conflicts, upgrade rollouts, and false positive tuning.

• Build production software: Develop, test, and deploy production Python services (not just scripts). Manage the full lifecycle including APIs, workers, queues, tests, CI, and containers.

• Automate detection and response: Partner with other teams in engineering to build automated containment or remediation workflows, including host isolation, process kills, file quarantine, account disabling, and ticket creation.

• Design safety guardrails: Architect strict guardrails on automated response actions—this is the strongest signal of success in the role. You will build approval thresholds, allow lists for critical hosts, rate limits on isolation actions, audit trails, and safe release or rollback paths.

• Own the platform in production: Take end‑to‑end ownership of the platform's reliability and latency outcomes (such as time from alert to containment), and participate in the on‑call rotation for security tooling.

• Build internal tooling: Create and maintain tools utilized by other teams, ensuring they are observable by debugging your own software with logging, metrics, or alerting you put in place.

Requirements:

• Deep, hands‑on experience operating multiple SIEM/SOAR/EDR platforms

• Proven software engineering experience building and maintaining production Python services and APIs.

• Experience integrating with complex vendor APIs and managing auth, rate limits, and retries.

• Demonstrated experience building automated detection and response workflows with carefully designed safety guardrails.

• Track record of taking end‑to‑end production ownership of a platform, rather than just a component.

Nice‑to‑haves:

• Experience managing multi‑tenant EDR structures

• Proficiency in Go and/or Python

• Detection‑as‑code experience (rules in version control, testing, CI deployment).

• Background working at MDR/MSSP providers, SOAR vendors, EDR vendor engineering teams, or on the detection and response teams of security‑mature technology companies.

Education & Certifications

• Bachelor’s or Master’s degree in Computer Science, Engineering, or a related field.

• Relevant certifications (AWS/GCP Professional Engineer, Kubernetes, or security‑related credentials) are a plus.

Why Join Us?

• Opportunity to work with cutting‑edge AI‑driven cybersecurity technologies and Google SecOps solutions.

• Collaborate with a talented and innovative team focused on continuously improving security operations.

• Competitive salary and benefits package.

• A culture of growth and development, with opportunities to expand your knowledge in AI, cybersecurity, and emerging technologies.