Principal Active Defense Engineer — AI-Driven Detection

Socket.dev; Reston (VA); On-site; USD 167,000 - 300,000; Full time

Job summary

Workday is seeking a Principal Active Defense Engineer to set technical direction for detection capabilities, spanning from threat intel translation to detections‑as‑code and CI/CD tooling. You will lead multi‑system initiatives, mentor engineers, and decide where AI and agents fit in detection work, while owning detection quality across the platform.

The role is hands‑on and requires a strong software or data engineering background with production experience in security, applied to security

Qualifications

• 10+ years in software, platform, or security engineering with production detections work.
• Experience setting technical direction and leading multi‑system initiatives.
• Proficiency in a general‑purpose language (Python/Java/JS) used for detection logic and automation.

Responsibilities

• Set the technical direction for the detection portfolio and framework.
• Lead large multi‑system initiatives from concept to production.
• Mentor engineers through design and code reviews and raise the team's technical ceiling.
• Shape how AI, agents, and automation are applied to detections and validation.
• Own detection quality, coverage, fidelity, and reducing noise.

Skills

Detection engineering

Technical leadership (IC)

Python/Java/JS

Detections-as-code/CI/CD

AI-assisted engineering

Splunk/cloud experience

Tools

Splunk

Cloud platforms

Job description

Workday is seeking a Principal Active Defense Engineer to set technical direction for detection capabilities, spanning from threat intel translation to detections‑as‑code and CI/CD tooling. You will lead multi‑system initiatives, mentor engineers, and decide where AI and agents fit in detection work, while owning detection quality across the platform.

The role is hands‑on and requires a strong software or data engineering background with production experience in security, applied to security