Staff / Principal Defensive Security Engineer, Frontier Cyber Models

Tykhe Inc; San Francisco (CA); On-site; USD 180,000 - 270,000; Full time

Job summary

Tykhe Inc. in San Francisco seeks a senior defender to architect and operat e defensive models that detect, correlate and triage real attacks. You will ground truth telemetry, build world-like SOC environments and translate analyst craft into scalable detections and playbooks.

You will lead threat research, malware analysis and cross-functional integration, shaping model-in-the-loop detections and SOC workflows across endpoint, cloud, identity and network domains.

Qualifications

• 5+ years hands-on defense experience (Staff) or 8+ (Principal).
• Experience across detection engineering, threat hunting, IR and forensics.
• Experience building detection programs and detection-as-code pipelines.
• IR leadership against sophisticated adversaries in enterprise or cloud.

Responsibilities

• Own defensive capability and set evaluation strategy for detection and response.
• Architect instrumented environments with realistic telemetry and labels.
• Translate analyst tradecraft into tools, playbooks and reward structures.
• Conduct threat research and malware analysis to inform detections.
• Design scalable correlation across sources mapped to MITRE ATT&CK.
• Develop detection pipelines using Sigma, KQL, SPL, ES|QL, YARA.
• Extend defensive benchmarks and held-out data for robust evals.
• Architect SOC integration with SIEM, XDR, SOAR and data lakes.
• Defend AI agents and detections against prompt injection and exfiltration.
• Collaborate with Offense in purple-team self-play and public disclosures.
• Lead field pilots and represent defensive research publicly.

Skills

Detection engineering

Threat hunting

Incident response

Forensics

SOC architecture

Threat intelligence

Malware analysis

Reverse engineering

Python

Go / Rust / TS

Kubernetes

IaC

Tools

Ghidra

IDA Pro

Sandboxes

Kubernetes

Job description

You are the defender in our client's self-play loop. You will turn what the best detection engineers, threat researchers, malware analysts, threat hunters and incident responders do into the environments, data, rewards and evaluations that make our client' Defense Modelsdetect, correlate, investigate and triage real attacks, with fewer false alarms and at a cost that lets them run on every event.

You will architecthow the model plugs into a real SOC: the telemetry it reads, the correlations it draws, the evidence it shows, and the actions it is trusted to take. You will work with design partners on their logs and workflows and bring that reality back into training.

What you'll do

• Own defensive capability for our client' DefenseModels. Set the technicaldirection and evaluation strategyfor detection, alerttriage, correlation, investigation and response recommendations.
• Build defensive Cyber World Models. Architect instrumented environments that produce realistic telemetry(EDR, cloud audit logs, identity,network, application and system logs, Kubernetes, SaaS, AI-agent traces) with ground-truth labels from the attacks our offense team runs.
• Encode the analyst.Translatedetection engineering, huntingand IR tradecraft into tools, skills,investigation playbooks, experttrajectories and rewardfunctions. Define what a correct, evidence-backed verdict looks like.
• Threat research and malware analysis. Track the actors, campaigns and malware families that targetour customers. Reverse-engineer samples, extract behaviors, TTPs and IOCs, and turn that research into detections, hunts, labeled scenarios and training data for the models.
• Correlation and investigation at scale. Design how the model links weak signals across sources and time into an attackstory mapped to MITRE ATT&CK, the kill chain and the asset and identity graph.
• Detection engineering with models in the loop. Build pipelines where the model drafts, tests and tunes detections (Sigma,KQL, SPL, ES|QL, YARA) againstreplayed attacks and benign baselines, and measures coverage and precision.
• Build and defend benchmarks. Extend our defensive evals (ExCyTIn-Bench-style investigations, DiagChain-style root cause, alert-triage precision/recall, time-to-verdict) and build held-out, contamination-resistant sets from real SOC data.
• Architect SOC integration. Design how our client' plugs into SIEM, XDR, SOAR, data lakes and ticketing (Splunk, Elastic, Sentinel, Chronicle, CrowdStrike, Cortex), with

human-in-the-loop controls,audit trails and safe autonomylevels.

• Defend AI agents too. Build detections and runtime controlsfor prompt injection, tool and MCP misuse, agent identity abuse and data exfiltration through agents.
• Partner with Offense.Run purple-team self-play: their campaigns becomeyour training data, and your detections become their target.
• Lead in the field and in public.Run design-partner pilots end to end and represent our client' defensive research in papers, talks and write-ups.

What you bring (must-haves)

• 5+ years hands-on defense (Staff), 8+ (Principal), across at least three of: detection engineering, threat hunting,incident response and forensics, SOC architecture, threat research and intelligence, malware analysis and reverse engineering.
• Built detection programs, not just rules. Designed detection-as-code pipelines, coverage modelsand tuning loopsat a large enterprise, cloudprovider, MDR or security vendor.
• Led investigations againstsophisticated adversaries. Real IR experience across endpoint, cloud, identity and network, ideally including nation-state or ransomware intrusions.
• Data and correlation depth. Strong at query languages and large-scale log pipelines; you understand entity resolution, timelines, baselining and why correlations fail.
• LLMs and AI agents in your daily work (required). You have built or extended LLM-driven triage, investigation, hunting or detection-authoring workflows and can show measured results. You know how to evaluate model verdicts and catch hallucinated evidence.
• Architecture across functions. You have designed how detection, response, threat intel, vulnerability management and cloud securityfit together in one operatingmodel.
• Strong engineer. Fluent in Python plus one of Go, Rust or TypeScript; comfortable with Kubernetes, IaC and streaming data.
• Judgment. You know what a SOC will trust and what it will ignore, and you can explain it to ML researchers, CISOs and analysts alike.
• RL and environments: built RL environments, simulators, reward functions or verifiers; worked on post-training for agentic tasks.
• Threat research and malware analysis. Hands-on reverse engineering of malware (Ghidra, IDA, debuggers, sandboxes) and originalresearch into adversary tradecraft that ended in shipped detections, hunts or published findings.
• Built agentic SOC productsor autonomous investigation features at a security vendor or AI lab.
• Threat intelligence tracking state-sponsored actors, with intelturned into detections and hunts.
• Detection and response for AI systems,using OWASP LLM / AgenticTop 10, MITRE ATLAS and NIST AI RMF.
• Publications, open-source detection content or talks at Black Hat, DEF CON, SANS, FIRST or similar.