Staff / Principal Defensive Security Engineer, Frontier

Tykhe Inc; San Francisco (CA); Hybrid; USD 180,000 - 240,000; Full time

Job summary

LSI Inc. is seeking a Staff or Principal Defensive Security Engineer (Frontier) in San Francisco, hybrid. You will lead the defender role in self-play loops, shaping detection, correlations, and investigations across SOC environments.

Expect work spanning malware analysis, threat research, and AI-enabled defenses with strong cross-team collaboration. You will design instrumented, ground-truth telemetry environments and define the analyst’s verdicts and playbooks, while partnering with offense on

Qualifications

• 5+ years hands-on defense across detection engineering, threat hunting, IR and forensics.

Responsibilities

• Own defensive capability for Defense Models and set direction for detection, alert triage, correlation and response.
• Build defensive Cyber World Models with instrumented environments and ground-truth labels from attacks.
• Translate analyst tradecraft into tools, playbooks, and reward functions with evidenced verdicts.
• Research and analyze threat actors, campaigns, and malware to build detections and hunts.
• Design how the model links signals across sources into MITRE ATT&CK-aligned stories.
• Develop detection pipelines and benchmarks for SOC integration and AI agent defense.

Skills

Defensive security

Threat hunting

Incident response

Forensics

SOC architecture

Malware analysis

Reverse engineering

Python

Go/Rust/TypeScript

Tools

Sigma

KQL

SPL

Elasticsearch/QL

YARA

Splunk

Elastic Security

Cortex

Job description

Staff / Principal Defensive Security Engineer, Frontier

Location: San Francisco / Bay Area (Hybrid) · Team: Defense · Level: Staff or Principal, set by

scope and track record

About company

lab, and the first SI lab to build self-improving cyber

models. Our models learn through offense–defense self-play inside LSI Cyber World Models:

realistic, instrumented environments where attacker and defender models train against each

other and every outcome is verified.

fix vulnerabilities before they become exploits.

detect, investigate and triage the exploits that get through. Both deliver frontier accuracy at

real-time speed, at a fraction of the cost of frontier general-purpose models on security

We are a team of security researchers, ML researchers and engineers. The people we hire turn

elite human tradecraft into the environments, rewards, evaluations and data that make our

models better every week. Learn more at lsi.inc.

The role

You are the defender in self-play loop. You will turn what the best detection engineers,

threat researchers, malware analysts, threat hunters and incident responders do into the

environments, data, rewards and evaluations that make LSI Defense Models detect, correlate,

investigate and triage real attacks, with fewer false alarms and at a cost that lets them run on

every event.

You will architect how the model plugs into a real SOC: the telemetry it reads, the correlations it

draws, the evidence it shows, and the actions it is trusted to take. You will work with design

partners on their logs and workflows and bring that reality back into training.

What you'll do

Own defensive capability for Defense Models. Set the technical direction and evaluation strategy for detection, alert triage, correlation, investigation and response recommendations.

Build defensive Cyber World Models. Architect instrumented environments that produce realistic telemetry (EDR, cloud audit logs, identity, network, application and

system logs, Kubernetes, SaaS, AI-agent traces) with ground-truth labels from the

attacks our offense team runs.

Encode the analyst. Translate detection engineering, hunting and IR tradecraft into

tools, skills, investigation playbooks, expert trajectories and reward functions. Define

what a correct, evidence-backed verdict looks like.

Threat research and malware analysis. Track the actors, campaigns and malware

families that target our customers. Reverse-engineer samples, extract behaviors, TTPs

and IOCs, and turn that research into detections, hunts, labeled scenarios and training

data for the models.

Correlation and investigation at scale. Design how the model links weak signals

across sources and time into an attack story mapped to MITRE ATT&CK, the kill chain

and the asset and identity graph.

Detection engineering with models in the loop. Build pipelines where the model

drafts, tests and tunes detections (Sigma, KQL, SPL, ES|QL, YARA) against replayed

attacks and benign baselines, and measures coverage and precision.

Build and defend benchmarks. Extend our defensive evals (ExCyTIn-Bench-style

and build held-out, contamination-resistant sets from real SOC data.

Architect SOC integration. Design how LSI plugs into SIEM, XDR, SOAR, data lakes

and ticketing (Splunk, Elastic, Sentinel, Chronicle, CrowdStrike, Cortex), with

human-in-the-loop controls, audit trails and safe autonomy levels.

Defend AI agents too. Build detections and runtime controls for prompt injection, tool

and MCP misuse, agent identity abuse and data exfiltration through agents.

Partner with Offense. Run purple-team self-play: their campaigns become your training

data, and your detections become their target.

Lead in the field and in public. Run design-partner pilots end to end and represent

LSI's defensive research in papers, talks and write-ups.

What you bring (must-haves)

5+ years hands-on defense (Staff), 8+ (Principal), across at least three of: detection

engineering, threat hunting, incident response and forensics, SOC architecture, threat

research and intelligence, malware analysis and reverse engineering.

Built detection programs, not just rules. Designed detection-as-code pipelines,

coverage models and tuning loops at a large enterprise, cloud provider, MDR or security

Led investigations against sophisticated adversaries. Real IR experience across

endpoint, cloud, identity and network, ideally including nation-state or ransomware

intrusions.

Data and correlation depth. Strong at query languages and large-scale log pipelines;

you understand entity resolution, timelines, baselining and why correlations fail.

LLMs and AI agents in your daily work (required). You have built or extended

LLM-driven triage, investigation, hunting or detection-authoring workflows and can show

measured results. You know how to evaluate model verdicts and catch hallucinated

evidence.

Architecture across functions. You have designed how detection, response, threat

intel, vulnerability management and cloud security fit together in one operating model.

Strong engineer. Fluent in Python plus one of Go, Rust or TypeScript; comfortable with

Kubernetes, IaC and streaming data.

Judgment. You know what a SOC will trust and what it will ignore, and you can explain it

to ML researchers, CISOs and analysts alike.

RL and environments: built RL environments, simulators, reward functions or verifiers;

worked on post-training for agentic tasks.

Threat research and malware analysis. Hands-on reverse engineering of malware

(Ghidra, IDA, debuggers, sandboxes) and original research into adversary tradecraft that

ended in shipped detections, hunts or published findings.

Built agentic SOC products or autonomous investigation features at a security vendor or

AI lab.

Threat intelligence tracking state-sponsored actors, with intel turned into detections and

hunts.

Detection and response for AI systems, using OWASP LLM / Agentic Top 10, MITRE

ATLAS and NIST AI RMF.

Publications, open-source detection content or talks at Black Hat, DEF CON, SANS,