Senior SOC Engineer - Agentic Security and Automation

SANS Institute; Bethesda (MD); Hybrid; USD 155,000 - 205,000; Full time

Benefits offered by this job

401(k) plan with company match

Medical, dental and vision plans

Short-term disability & life insurance

Company-paid EAP

Job summary

SANS Institute is seeking a Senior SOC Engineer - Agentic to shape the design and buildout of our agentic SOC, driving detection engineering, automation, and AI agent infrastructure for a lean security team. You will also perform hands-on security engineering across vulnerability management, cloud security, IAM, and application security.

Initially the role balances two tracks, with growth as the Agentic SOC matures.

Qualifications

• 7+ years in security operations or security automation with leadership potential.
• Detection engineering experience: writing/tuning detections, measuring efficacy.
• MITRE ATT&CK fluency as a working tool.
• Hands-on experience with EDR and SIEM platforms in production.
• Ability to design end-to-end security operations pipelines with clear automation fit.
• Systems thinking: data flows, dependencies, failure modes, architectural decisions.
• Experience designing for scale and maintainability in small teams.
• Knowledge of threat modeling concepts applied to security infrastructure.
• Strong Python with testing and version control.
• Comfort building integrations against REST APIs across heterogeneous security tools.
• Experience with SOAR platforms or equivalent tooling.
• Git-based workflows and an as-code mindset for detections and automations.
• Working knowledge of AWS; Azure/GCP a plus.
• Curiosity about LLM-based agents vs traditional automation.
• Willingness to learn MCP/server prompts engineering on the job.
• Familiarity with JSON/Markdown as tooling.
• Calibrated skepticism about over-automation.

Responsibilities

• Design the architecture of the agentic SOC and data flow for detections and responses.
• Build and own detection engineering across the SIEM environment.
• Translate SOC operations into automation and define agent-assisted workflows.
• Develop integrations across MSSP, EDR, SIEM, and cloud platforms.
• Collaborate with AI Engineering to build the agent stack and governance.
• Operate, monitor, and improve agent performance and outcomes.
• Lead vulnerability management, cloud security, IAM, and app security.
• Perform security architecture reviews and ensure compliance support.
• Respond to incidents as part of the security engineering function.
• Pursue related duties as assigned.

Skills

SOC engineering

Detection engineering

MITRE ATT&CK fluency

EDR/SIEM experience

Security operations pipelines

Systems thinking

Architecture documentation

Threat modeling

Python

REST API integrations

SOAR platforms

Git workflows

AWS

Azure/GCP familiarity

Agent frameworks / MCP

JSON/Markdown

Ambiguity tolerance

US work authorization

Tools

MSSP platforms

EDR

SIEM

REST APIs

Job description

SANS Institute is seeking a Senior SOC Engineer - Agentic to shape the design and buildout of our agentic SOC, driving detection engineering, automation, and AI agent infrastructure for a lean security team. You will also perform hands-on security engineering across vulnerability management, cloud security, IAM, and application security.

Initially the role balances two tracks, with growth as the Agentic SOC matures.