SANS Institute

Security Operations

• Design the architecture of the agentic SOC
• Define data flows through detection and response pipelines
• Define agent structure, orchestration, human-in-the-loop checkpoints, and system evolution
• Write, tune, and maintain detections across the internal SIEM environment
• Establish a detection lifecycle of design, deploy, measure, tune, and improve
• Identify alert triage, investigation, and response work suitable for agent augmentation
• Build integrations, scripts, and playbooks across MSSP, EDR, SIEM, cloud infrastructure, and identity platforms
• Partner with AI Engineering to build and govern the agent stack
• Co-design MCP servers and tool integrations
• Contribute to prompt design, evaluation harnesses, and feedback loops
• Own audit trails and checkpoints for safe and accountable agent actions
• Monitor agent performance, investigate failures, tune behavior, and incorporate real-world outcomes
• Own vulnerability identification, prioritization, and remediation tracking
• Assess and improve AWS and Azure cloud security posture
• Review IAM policies, harden configurations, implement cloud-native detection, and monitor posture
• Partner on identity architecture, access reviews, privilege management, and authentication standards
• Conduct code reviews, threat models, and security assessments for internal applications and integrations
• Evaluate technologies, integrations, and infrastructure changes for security risk
• Provide pragmatic, risk-based security guidance
• Support compliance activities, evidence collection, and audit engagements
• Respond to security incidents
• Perform other related duties as assigned

Senior SOC Engineer