Security Technical Lead - AI SOC

AHEAD; United States; On-site; USD 150,000 - 210,000; Full time

Job summary

AHEAD is seeking a Security Technical Lead - AI SOC to drive production security outcomes by embedding with customer security and engineering teams. This role focuses on AI-enabled security operations, detection, and response across complex enterprise environments.

You'll leverage AI-assisted tooling to strengthen detection quality, accelerate investigations, and automate response while guiding security governance for AI systems.

Qualifications

• Design and implement integrations across SIEM, XDR, SOAR, and related security platforms.
• Build security telemetry pipelines with ingestion, normalization, enrichment, routing, and access controls.
• Translate threat intelligence and MITRE ATT&CK into prioritized detection use cases and measurable coverage improvements.

Responsibilities

• Deliver production-ready security outcomes with customer teams.
• Lead architecture design sessions and threat modeling workshops.
• Define pragmatic improvement roadmaps based on gaps and objectives.
• Own delivery outcomes across customer, AHEAD, and partner teams.
• Communicate risk in business terms and provide actionable recommendations.

Skills

Security engineering

Threat modeling

Incident response

AI-assisted development tools

Security tooling

Tools

SIEM

XDR

SOAR

AI tooling

Job description

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

AtAHEAD, we prioritize creating a culture of belonging,where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer,anddo not discriminatebased onan individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, maritalstatus,or any other protected characteristic under applicable law, whether actual or perceived.

We embraceall candidatesthatwillcontribute to the diversification and enrichment of ideas andperspectives atAHEAD.

The Security Technical Lead - AI SOC is a production security engineer who works embedded with customer security and engineering teams to make security operations more effective, measurable, and resilient. This role owns outcomes across assessment, design, build, deployment, optimization, and operational handoff.

The primary profile is a security engineer with meaningful AI experience. You should understand how security controls operate in production, how telemetry becomes detection and response, and how to reduce risk across complex enterprise environments. You will use AI and automation to strengthen those outcomes: improving detection quality, accelerating investigations, automating response, and helping customers securely govern and operate AI systems.

This is not a theoretical AI research role or a compliance-only position. It is a hands-on engineering role requiring the ability to design, build, integrate, troubleshoot, and operate security solutions in real customer environments. AI-assisted development tools such as Claude Code, Cursor, GitHub Copilot, or similar tools may be part of your standard delivery practice for building security tooling, detection content, automation, and governance capabilities.

Responsibilities

Embedded Security Engineering and Delivery

• Work hand-in-hand with customer security, engineering, platform, and infrastructure teams to deliver production-ready security outcomes.
• Serve as the technical lead for security engineering engagements from discovery and assessment through hardened deployment and optimization.
• Assess security posture, operational requirements, business objectives, and existing tooling; identify gaps and define pragmatic improvement roadmaps.
• Translate business, operational, compliance, and security requirements into secure architectures, implementation plans, and measurable outcomes.
• Own delivery outcomes, identify blockers early, and drive execution across customer, AHEAD, and partner teams.
• Lead architecture design sessions, threat modeling workshops, implementation reviews, and hands-on working sessions with customer technical and security leaders.
• Communicate security risk in business terms, translating threat exposure and operational gaps into clear, risk-adjusted recommendations.
• Act as a trusted advisor during onboarding, implementation, rollout, operational handoff, and continuous improvement.

Security Operations, Detection, and Response

• Design and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.
• Build and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.
• Partner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.
• Define, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.
• Translate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.
• Validate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort.
• Establish detection-as-code practices, including version control, peer review, documentation, testing, change management, and promotion across environments.
• Own SIEM and security-data management across, schema mapping, parsing, normalization, enrichment, routing, retention, access controls, and cost/performance optimization.
• Define telemetry requirements and data-quality controls; monitor ingestion health, freshness, completeness, duplication, parsing failures, and coverage across identity, endpoint, cloud, network, SaaS, application, and AI sources.
• Develop and operationalize playbooks and automated workflows for investigation, containment, enrichment, escalation, and response.
• Build security tooling and detection systems that improve signal quality, reduce analyst burden, and accelerate time to response.
• Support behavioral analytics, anomaly detection, correlation, risk scoring, and other security analytics use cases.
• Define and track practical measures of security improvement, including detection coverage, response efficiency, automation coverage, false-positive reduction, and risk reduction.
• Troubleshoot integration issues, deployment blockers, data-quality problems, and production incidents in partnership with security, cloud, platform, and infrastructure teams.

Secure AI and AI-Enabled Security Operations

• Apply AI and automation to security outcomes such as alert enrichment, triage support, investigation summarization, clustering, playbook selection, threat analysis, and analyst copilots.
• Help customers securely adopt LLM, RAG, and agentic capabilities within security operations and broader enterprise environments.
• Lead or support threat modeling for AI-enabled architectures, including LLM applications, multi-agent workflows, RAG systems, vector databases, model endpoints, inference APIs, data pipelines, and MLOps platforms.
• Identify, assess, and mitigate AI-specific risks such as prompt injection, data leakage, data poisoning, model abuse, insecure integrations, excessive permissions, tool misuse, model extraction, and AI supply-chain risk.
• Define practical AI security guardrails covering identity, least privilege, data protection, human oversight, auditability, validation, monitoring, and safe failure modes.
• Secure AI control planes, data flows, model integrations, inference services, and non-human identities across AWS, Azure, GCP, and hybrid environments.
• Support AI governance implementation using practical controls and operating models aligned to frameworks such as NIST AI RMF, applicable regulations, and customer risk requirements.
• Contribute to AI-specific detection content, incident taxonomies, playbooks, tabletop exercises