Principal Defensive Security Engineer - AI & SOC Architect

Tykhe Inc; San Francisco (CA); On-site; USD 180,000 - 270,000; Full time

Job summary

Tykhe Inc. in San Francisco seeks a senior defender to architect and operat e defensive models that detect, correlate and triage real attacks. You will ground truth telemetry, build world-like SOC environments and translate analyst craft into scalable detections and playbooks.

You will lead threat research, malware analysis and cross-functional integration, shaping model-in-the-loop detections and SOC workflows across endpoint, cloud, identity and network domains.

Qualifications

• 5+ years hands-on defense experience (Staff) or 8+ (Principal).
• Experience across detection engineering, threat hunting, IR and forensics.
• Experience building detection programs and detection-as-code pipelines.
• IR leadership against sophisticated adversaries in enterprise or cloud.

Responsibilities

• Own defensive capability and set evaluation strategy for detection and response.
• Architect instrumented environments with realistic telemetry and labels.
• Translate analyst tradecraft into tools, playbooks and reward structures.
• Conduct threat research and malware analysis to inform detections.
• Design scalable correlation across sources mapped to MITRE ATT&CK.
• Develop detection pipelines using Sigma, KQL, SPL, ES|QL, YARA.
• Extend defensive benchmarks and held-out data for robust evals.
• Architect SOC integration with SIEM, XDR, SOAR and data lakes.
• Defend AI agents and detections against prompt injection and exfiltration.
• Collaborate with Offense in purple-team self-play and public disclosures.
• Lead field pilots and represent defensive research publicly.

Skills

Detection engineering

Threat hunting

Incident response

Forensics

SOC architecture

Threat intelligence

Malware analysis

Reverse engineering

Python

Go / Rust / TS

Kubernetes

IaC

Tools

Ghidra

IDA Pro

Sandboxes

Kubernetes

Job description

Tykhe Inc. in San Francisco seeks a senior defender to architect and operat e defensive models that detect, correlate and triage real attacks. You will ground truth telemetry, build world-like SOC environments and translate analyst craft into scalable detections and playbooks.

You will lead threat research, malware analysis and cross-functional integration, shaping model-in-the-loop detections and SOC workflows across endpoint, cloud, identity and network domains.