Senior SOC Engineer - Agentic

We need to output HTML fragment with sections: About the role? Actually the posting includes "About SANS" (company description) and "Why SANS?" and "What You’ll Achieve At SANS" then "As a Senior SOC Engineer - Agentic, You Will" with bullet points (list). Then "What We’re Looking For" (requirements). Then "Preferred Qualifications". Then "Benefits And Perks Of Working At SANS". Also salary range (Pay). Also schedule? Not mentioned. So we need sections: About the role? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We need to include sections only when posting has real specific content. We have content for About the role? The posting includes "About SANS" and "Why SANS?" and "What You’ll Achieve At SANS". Could treat as "About the role" maybe combine? But we should not repeat job title as heading. We can have sections: About the role (maybe summarizing description). But we must preserve all substantive info; we cannot invent or summarize away detail. We need to include the content as is, using

for prose and

• for lists. We need to decide headings: Could use "About the role" for the description of SANS and mission etc. Then "Responsibilities" for the bullet list under "As a Senior SOC Engineer - Agentic, You Will". Then "Requirements" for "What We’re Looking For". Then "Qualifications" for "Preferred Qualifications". Then "Benefits" for benefits section. Then "Pay" for salary range. No schedule. We must not include boilerplate like EEO etc. Remove those. We must preserve all substantive info: include details about SANS founding, mission, etc. Must not omit. We need to output only HTML fragment, no /, no markdown fences. Let's craft:

  About the role

  About SANS Founded in 1989, SANS Institute (SANS) began as a cooperative research and education organization. Over the next 25 years, it grew to become the most trusted and widely recognized provider of information security training and certification in the world. Today, SANS has served more than 300,000 cybersecurity professionals around the world, with more than 60,000 earning Global Information Assurance Certification (GIAC) security certifications—the leading certification that provides assurance to employers that their people and prospective hires can do the job. At the heart of SANS is a community of practitioners, from auditors and network administrators to CISOs, who share their lessons learned and collaborate on solutions to the challenges they face. These experts, working across corporations, government agencies, and universities, come together to support and strengthen the global information security community. Why SANS? At SANS, our culture is defined by three pillars: Mission, Brand, and People. Our Mission is to hire people who understand the importance fighting against cybersecurity threats.Our Brand reflects a commitment to delivering the highest quality training. Our People are grounded in a culture of fairness, honesty, customer focus, and a pragmatic approach. What You’ll Achieve At SANS We are seeking a Senior SOC Engineer - Agentic to join our Security team. This role is a dual-focus security engineering role. On one side, this engineer owns the design and buildout of our agentic SOC — building the detection engineering, automation, and AI agent infrastructure that allows a lean security team to operate at the scope of a much larger one. On the other, they serve as a hands-on security engineer across the full breadth of the program: vulnerability management, cloud security, identity and access management, application security, architecture reviews, and compliance support. Initially the role will split roughly evenly between these two tracks. As the Agentic SOC matures and AI agents absorb more of the operational workload, the balance will shift — but the security engineering work never goes away. This is a role for someone who wants to do real security engineering today while building the systems that redefine what security engineering looks like tomorrow.

  Then responsibilities list. We need to extract bullet points from "As a Senior SOC Engineer - Agentic, You Will". The bullet points are paragraphs each starting with a bold heading? Actually they are sentences with headings like "Agentic SOC Buildout", then sub-bullets? Let's parse: "As a Senior SOC Engineer - Agentic, You Will Agentic SOC BuildoutDesign the architecture of the agentic SOC. Define how data flows through the detection and response pipeline, how agents are structured and orchestrated, where human-in-the-loop checkpoints belong, and how the overall system evolves as we expand agent autonomy. Build and own detection engineering. Write, tune, and maintain detections across our internal SIEM environment. Treat detection content as code — version-controlled, peer-reviewed, tested, measured. Establish the lifecycle of design → deploy → measure → tune → improve. Translate SOC operations into automation. Identify the alert triage, investigation, and response work that is ripe for agent augmentation, and define what good looks like for each workflow before it gets handed to an agent. Build automations and integrations across our stack. Connect our MSSP, EDR, SIEM, cloud infrastructure, and identity platforms through integrations, scripts, and playbooks — both deterministic automation where that is the right tool, and agent-driven workflows where it is not. Partner with AI Engineering to build and govern the agent stack. Co-design the MCP servers and tool integrations that let agents work with security systems. Contribute to prompt design, evaluation harnesses, and feedback loops — and own the audit trails and checkpoints that keep agent actions safe and accountable. Operate and improve. Monitor agent performance, investigate failures, tune behavior, and feed real-world outcomes back into the system. The job does not end when something ships. Security Engineering Vulnerability management. Own the vulnerability identification, prioritization, and remediation tracking program. Work with engineering and infrastructure teams to drive risk reduction across the environment. Cloud security. Assess and improve cloud security posture across AWS and Azure — identity and access management (IAM) policy review, configuration hardening, cloud-native detection, and ongoing posture monitoring. Identity and access management. Partner with IT and engineering on identity architecture, access reviews, privilege management, and authentication standards. Application security. Conduct code reviews, threat models, and security assessments for internal applications and integrations. Partner with development teams to shift security left. Security architecture reviews. Evaluate new technologies, integrations, and infrastructure changes for security risk. Provide pragmatic, risk-based guidance. Compliance and audit support. Support security compliance activities, evidence collection, and audit engagements as needed. Respond to incidents. When something real happens, you are part of the response. The agents help; they do not replace you. Perform other related duties as assigned." We can treat each line as a list item. So
  • ... etc. Now Requirements: "What We’re Looking For Every SANS employee brings something unique. For this role, we’re looking for candidates with:" then list of bullet points (each line starting with something). We'll capture each as
  • . Preferred Qualifications: "Preferred Qualifications Include Experience with MSSP-managed detection and response environments." then list. Benefits: "Benefits And Perks Of Working At SANS We’re committed to fair and equitable compensation. The expected salary range for this position is $155,000 to $205,000 which is comprised of base salary and bonus, depending on geographic location, skills, and experience. At SANS, pay equity and transparency are priorities. Benefits We offer a comprehensive benefits package that supports your total well-being so you can be and deliver your best. This means caring for you and your loved ones' physical, financial, and mental health, as well as providing the flexibility you need to thrive personally and professionally: Financial Benefits: Competitive base salary, bonus opportunities, and a 401(k) plan with company match.Health & Wellness: Robust medical, dental, and vision plans; company-provided short term disability; optional long-term disability, supplemental life and AD&D insurance for employees and dependents; voluntary benefits including accident insurance and identity theft protection; fitness and wellness programs; and a company paid employee assistance program (EAP).Time Off & Flexibility: Generous paid time off, including volunteer time.Learning & Development: Access to professional development and SANS training opportunities. Flexibility and Balance at SANS We support our colleagues with the tools and flexibility they need to thrive, both professionally and personally. As a primarily remote work environment, we are committed to maintaining strong connections, collaboration, and a vibrant culture across virtual teams. While most roles operate remotely, some positions may require occasional in-person presence depending on role-specific or business needs." We need Pay section separate: salary range. Benefits section separate: benefits details. We should not include EEO etc. Let's construct HTML. We'll have:

    About the role

    ... (the combined About SANS, Why SANS, What You’ll Achieve At SANS up to before responsibilities)

    Responsibilities

    • Agentic SOC Buildout: Design the architecture of the agentic SOC. Define how data flows through the detection and response pipeline, how agents are structured and orchestrated, where human-in-the-loop checkpoints belong, and how the overall system evolves as we expand agent autonomy.
    • Build and own detection engineering: Write, tune, and maintain detections across our internal SIEM environment. Treat detection content as code — version-controlled, peer-reviewed, tested, measured. Establish the lifecycle of design → deploy → measure → tune → improve.
    • Translate SOC operations into automation: Identify the alert triage, investigation, and response work that is ripe for agent augmentation, and define what good looks like for each workflow before it gets handed to an agent.
    • Build automations and integrations across our stack: Connect our MSSP, EDR, SIEM, cloud infrastructure, and identity platforms through integrations, scripts, and playbooks — both deterministic automation where that is the right tool, and agent-driven workflows where it is not.
    • Partner with AI Engineering to build and govern the agent stack: Co-design the MCP servers and tool integrations that let agents work with security systems. Contribute to prompt design, evaluation harnesses, and feedback loops — and own the audit trails and checkpoints that keep agent actions safe and accountable.
    • Operate and improve: Monitor agent performance, investigate failures, tune behavior, and feed real-world outcomes back into the system. The job does not end when something ships.
    • Security Engineering – Vulnerability management: Own the vulnerability identification, prioritization, and remediation tracking program. Work with engineering and infrastructure teams to drive risk reduction across the environment.
    • Security Engineering – Cloud security: Assess and improve cloud security posture across AWS and Azure — identity and access management (IAM) policy review, configuration hardening, cloud-native detection, and ongoing posture monitoring.
    • Security Engineering – Identity and access management: Partner with IT and engineering on identity architecture, access reviews, privilege management, and authentication standards.
    • Security Engineering – Application security: Conduct code reviews, threat models, and security assessments for internal applications and integrations. Partner with development teams to shift security left.
    • Security Engineering – Security architecture reviews: Evaluate new technologies, integrations, and infrastructure changes for security risk. Provide pragmatic, risk-based guidance.
    • Security Engineering – Compliance and audit support: Support security compliance activities, evidence collection, and audit engagements as needed.
    • Security Engineering – Respond to incidents: When something real happens, you are part of the response. The agents help; they do not replace you.
    • Perform other related duties as assigned.

    Requirements

    • 7+ years in security operations, detection engineering, or security automation, with enough depth to lead engineering efforts independently — and