Senior AI SOC Engineer - Post-Detection Automation (Remote)

Cribl; Annapolis (MD); Remote; USD 230,000 - 280,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short‑term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a Senior Staff Software Engineer for its Security Products team to architect post‑detection workflows and build autonomous investigation and response capabilities. You will leverage LLMs, embeddings, and contextual graphs to enable machine‑speed SOC operations in a remote‑first environment.

The role demands 12+ years of scalable software experience, deep security workflow knowledge, and expertise in JavaScript/TypeScript, NodeJS, or Go/Python.

Qualifications

• Bachelor's degree in Computer Science, Electrical Engineering, or equivalent experience (Master's preferred).
• 12+ years of experience building scale production software.
• Experience leading AI SOC, SOAR, or post‑detection automation capabilities at scale.
• Deep experience with LLM orchestration frameworks, embeddings, vector databases, dynamic tool calling, and RAG architectures.
• Track record designing scalable, low‑latency distributed systems for asynchronous event processing.
• Deep understanding of the MITRE ATT&CK framework.
• Strong API design for interfacing with third‑party security platforms (EDR, IdP, Cloud, SIEM/SOAR).
• Proven ability to lead autonomous initiatives from concept to production.
• High ownership mindset with focus on quality, performance, and simplicity.
• Excellent written and verbal communication for remote, distributed teams.
• Experience building autonomous agent frameworks for security context.
• Active open‑source contributions in AI, agentic automation, or security.
• Witty, collaborative team player with a sense of humor.

Responsibilities

• Architect post‑detection workflows, including autonomous triage, agentic investigation, evidence synthesis, and containment orchestration.
• Build production‑grade reasoning systems using LLMs, embeddings, and context graphs to formulate hypotheses, gather evidence, and deliver explainable verdicts.
• Work closely with Cribl Detect to ingest high‑fidelity detection signals and trigger automated investigations and responses.
• Explore agentic paradigms, multi‑agent frameworks, and natural language SOC interfaces with functional prototypes.
• Write core abstractions, design agent communication protocols, and establish benchmarks for model accuracy, latency, and reliability.
• Build safe execution frameworks offering transparent reasoning trails, chains of custody, and human‑in‑the‑loop controls.
• Partner with product managers and stakeholders to translate ambiguous ideas into executable technical plans.
• Guide engineering talent and represent Cribl's AI SOC vision via architecture reviews, blogs, and discussions.
• This role may require stand‑by, on‑call, or off‑hours duties.

Skills

AI SOC

Post‑detection

Distributed systems

LLM orchestration

Agent frameworks

Security context

API design

Leadership

Communicator

Open‑source

Security workflows

NodeJS

Go/Python

Graph databases

Team collaboration

Education

Bachelor's degree in Computer Science / Electrical Engineering (Master's preferred)

Tools

NodeJS

Go

Python

JavaScript/TypeScript

Embeddings

Job description

Cribl is seeking a Senior Staff Software Engineer for its Security Products team to architect post‑detection workflows and build autonomous investigation and response capabilities. You will leverage LLMs, embeddings, and contextual graphs to enable machine‑speed SOC operations in a remote‑first environment.

The role demands 12+ years of scalable software experience, deep security workflow knowledge, and expertise in JavaScript/TypeScript, NodeJS, or Go/Python.