Security Technical Lead - AI SOC

AHEAD; Chicago (IL); On-site; USD 150,000 - 210,000; Full time

Job summary

AHEAD is seeking a Security Technical Lead - AI SOC to join our engineering teams and embed with customer security and product teams to strengthen security operations across complex enterprise environments.

You will design, build, and integrate security tooling, use AI-assisted development methods, and lead threat modeling, detections, and incident response in production. This role focuses on measurable security outcomes and secure governance of AI systems for client environments.

Qualifications

• Hands-on security engineering experience in production environments.
• Experience designing secure architectures and threat modeling.
• Ability to translate security requirements into measurable outcomes.

Responsibilities

• Work with customer security, engineering, platform, and infra teams to deliver production-ready security outcomes.
• Lead security engagements from discovery to hardened deployment and optimization.
• Assess posture, requirements, and tooling; identify gaps and define improvement roadmaps.
• Translate requirements into secure architectures and measurable outcomes.
• Own delivery outcomes, identify blockers, and drive cross-team execution.
• Lead architecture design sessions, threat modeling, and reviews with customer leaders.
• Communicate risk in business terms with clear recommendations.
• Act as trusted advisor during onboarding to ongoing improvements.
• Design and implement integrations across SIEM, XDR, SOAR, and security platforms.
• Build and operate security telemetry pipelines with proper controls.
• Partner with SOC to improve detection and incident response.
• Develop and tune detections across SIEM/XDR using queries and analytics.
• Translate threat intel and MITRE techniques into detection use cases.
• Validate detections via tests and exercises; monitor false positives and fidelity.

Skills

Security engineering

AI security

Security architecture

Threat modeling

Tools

SIEM

XDR

SOAR

Job description

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived. We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

The Security Technical Lead - AI SOC is a production security engineer who works embedded with customer security and engineering teams to make security operations more effective, measurable, and resilient. This role owns outcomes across assessment, design, build, deployment, optimization, and operational handoff.

The primary profile is a security engineer with meaningful AI experience. You should understand how security controls operate in production, how telemetry becomes detection and response, and how to reduce risk across complex enterprise environments. You will use AI and automation to strengthen those outcomes: improving detection quality, accelerating investigations, automating response, and helping customers securely govern and operate AI systems.

This is not a theoretical AI research role or a compliance-only position. It is a hands-on engineering role requiring the ability to design, build, integrate, troubleshoot, and operate security solutions in real customer environments. AI-assisted development tools such as Claude Code, Cursor, GitHub Copilot, or similar tools may be part of your standard delivery practice for building security tooling, detection content, automation, and governance capabilities.

Responsibilities

Embedded Security Engineering and Delivery

• Work hand-in-hand with customer security, engineering, platform, and infrastructure teams to deliver production-ready security outcomes.
• Serve as the technical lead for security engineering engagements from discovery and assessment through hardened deployment and optimization.
• Assess security posture, operational requirements, business objectives, and existing tooling; identify gaps and define pragmatic improvement roadmaps.
• Translate business, operational, compliance, and security requirements into secure architectures, implementation plans, and measurable outcomes.
• Own delivery outcomes, identify blockers early, and drive execution across customer, AHEAD, and partner teams.
• Lead architecture design sessions, threat modeling workshops, implementation reviews, and hands-on working sessions with customer technical and security leaders.
• Communicate security risk in business terms, translating threat exposure and operational gaps into clear, risk-adjusted recommendations.
• Act as a trusted advisor during onboarding, implementation, rollout, operational handoff, and continuous improvement.

Security Operations, Detection, and Response

• Design and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.
• Build and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.
• Partner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.
• Define, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.
• Translate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.
• Validate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort