AI Cyber Lead

Role Overview

Location: New York, NY – Reports to: Senior Manager Incident Response.

The Senior AI Cyber Lead serves as the primary technical and strategic expert and point of reference for AI‑driven security capabilities within the CSIRT. This senior individual‑contributor role drives the design, development, and operationalization of agentic AI solutions across security platforms and processes—from Cortex XSIAM and related cybersecurity tools to broader detection, investigation, and incident‑response workflows. Acting as the key bridge between the CSIRT and Threat Hunting, Threat Intel, Red Team, Forensics, and Group Security Technology teams, the role ensures AI innovations are securely configured, integrated, scaled effectively, and aligned with enterprise security strategy while elevating the team’s overall AI maturity in complex, scattered environments.

Responsibilities

• Serve as the main technical point of reference and subject‑matter expert for all AI development efforts within the CSIRT, partnering with analysts and engineers on best practices for agentic AI, LLM integration, RAG pipelines, secure automation, and AI governance in security operations.
• Lead the design, prototyping, and implementation of AI‑powered enhancements spanning Cortex XSIAM (including AI SmartScoring, technique‑based incident grouping, and SOAR playbooks) and other security platforms, focusing on automated incident triage and enrichment, threat hunting, investigation assistance, and response orchestration to deliver measurable reductions in CSIRT KPIs (MTTx).
• Architect and operationalize agentic AI systems and workflows that improve SOC efficiency, reduce mean time to detect and respond, and support complex incident‑response processes while embedding robust guardrails, human‑in‑the‑loop controls, auditability, least‑privilege principles, and secure‑by‑default patterns aligned with enterprise risk and regulatory requirements (e.g., China, Korea).
• Act as the primary liaison and technical bridge between the CSIRT and other teams (Threat Hunting, Threat Intel, Red Team, Forensics, Group Security Technology), translating operational needs into AI solutions, aligning roadmaps, and ensuring consistent, secure adoption of AI capabilities across platforms and processes.
• Identify high‑impact AI use cases, conduct threat modeling for AI systems (including prompt injection, tool‑use risks, data exposure, autonomous agent behaviors, and identity/security posture risks), and drive continuous improvement of AI‑enabled defenses.
• Evaluate emerging market solutions, frameworks, and techniques in agentic AI for SOCs and incident response; pilot promising technologies; and contribute to the definition of secure‑by‑default patterns, reference architectures, and operational standards for AI in security, including alignment with internal AI council regulatory frameworks.
• Support knowledge sharing, mentor SOC analysts, and document agentic developments, safe prompt libraries, evaluation frameworks, and best practices to accelerate responsible AI adoption and elevate AI maturity across the team.
• Generate periodic reports, metrics, and insights on AI capability maturity, performance, and risk posture; govern agents, models, and their interactions to ensure auditability and alignment with enterprise security and compliance priorities.
• Communicate effectively with senior management, executives, and C‑suite leaders as needed.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Artificial Intelligence/Machine Learning, Cyber Risk Strategy and Governance, or a related technical field (or equivalent practical experience); Master’s degree preferred.
• Minimum 3–5 years of professional experience in technology or advanced engineering environments (preferably within cybersecurity, security operations, detection engineering, AI security, or AI/ML engineering in enterprise or regulated settings), with hands‑on work applying AI/ML and agentic workflows to security use cases such as SOC triage, enrichment, and secure AI adoption.
• Strong practical expertise in agentic AI systems, large language models (LLMs), retrieval‑augmented generation (RAG), multi‑agent orchestration, tool‑using agents, and related frameworks; familiarity with Claude (including Claude Code) or GPT series. Experience securing, operationalizing, and governing such systems in production security environments is highly valued.
• Hands‑on experience with modern security‑operations platforms (e.g., Cortex XSIAM / Cortex XDR, SIEM, SOAR, XDR) or equivalents such as Microsoft Sentinel, Defender XDR, Purview, and Entra ID, with application of AI features for detection, triage, enrichment, and automated response or agent development.
• Solid understanding of SOC workflows, incident‑response processes, threat detection, and security telemetry, combined with knowledge of AI‑specific risks (prompt injection, excessive agency, data leakage, model abuse, authorization weaknesses) and mitigation strategies.