Remote AI Security Engineer - Response & Automation

Openkrill; United States; Remote; USD 60,000 - 100,000; Full time

Benefits offered by this job

Remote-first

Wellbeing programs

Volunteer days

Job summary

Sophos is seeking a high-caliber security professional to independently detect, investigate, and respond to cyber threats across Sophos and its products while engineering detections, automations, reusable skills and agentic workflows. You will leverage AI-driven practices to scale internal detection and response with measurable outcomes.

The role blends incident response judgement with security engineering, safe tooling, and observable workflows to drive speed and accuracy in investigations.

Qualifications

• Strong enterprise incident response experience across endpoint, identity, cloud, network and product-focused investigations.
• Practical capability in DFIR, endpoint and firewall forensics, threat hunting, detection engineering and analysis of unstructured telemetry.
• Ability to write reliable automation in Python or a comparable language, work with APIs and query data using SQL.
• Working knowledge of Git and GitHub engineering practices, including pull requests, code review, testing and CI/CD concepts.

Responsibilities

• Own complex investigations across the incident lifecycle, from triage and evidence collection through containment, recovery and lessons learned.
• Act as a trusted front door for security issues, coordinating response across IDR, engineering, product and business teams.
• Perform DFIR and endpoint forensics, including log, network and packet analysis, malware analysis and firewall investigation where applicable.
• Write and improve detections, playbooks, orchestrations and preventions using evidence from incidents and threat hunting.
• Build production-quality automation that removes repetitive work, improves consistency and enables analysts to operate at a higher layer.
• Design model-agnostic, reusable skills and workflows that run across approved AI and agent platforms rather than depending on one model.
• Use Claude, Codex, Copilot and future approved tooling to accelerate investigations, coding, testing, documentation and detection engineering.
• Contribute through GitHub: create branches, raise and review pull requests, write tests, respond to feedback and support controlled deployment.
• Instrument agentic workflows with logs, traces, metrics, evaluation results and failure signals so behaviour and outcomes are observable.
• Apply safe harness design, least privilege, scoped tool access, approval gates, evidence validation, rollback and human review for consequential actions.
• Communicate incidents, risks, decisions and technical outcomes clearly to engineering and leadership audiences.

Skills

Incident response

DFIR

Python

GitHub

Security tooling

Threat hunting

Tools

Claude

Codex

Copilot

GitHub

Job description

Sophos is seeking a high-caliber security professional to independently detect, investigate, and respond to cyber threats across Sophos and its products while engineering detections, automations, reusable skills and agentic workflows. You will leverage AI-driven practices to scale internal detection and response with measurable outcomes.

The role blends incident response judgement with security engineering, safe tooling, and observable workflows to drive speed and accuracy in investigations.