AI SOC Engineer

Job Description

About the Role

We are looking for an AI SOC Engineer who combines deep offensive/defensive security expertise with hands-on AI engineering skills. You will be the core builder of our “Security Brain” — leveraging LLMs and AI agents to automate detection rule generation, suppress alert noise, and drive fully automated security operations. Using AI to fight AI, you will help ByLab’s SOC stay ahead of increasingly sophisticated, AI-powered adversaries.

Key Responsibilities

\n
• Use LLMs and AI tools to automate generation, testing, and continuous optimization of SIEM/EDR/NDR detection rules based on threat intelligence and ATT&CK TTPs
\n
• Build a full detection rule lifecycle management system: auto-generate → validate → deploy → evaluate → iterate
\n
• Design and implement AI/ML-based alert triage, prioritization, and false-positive suppression models to continuously reduce MTTD/MTTR
\n
• Build AI Agent-driven alert automation pipelines: triage → context enrichment → automated verdict → response recommendation
\n
• Architect the “Security Brain”: integrate threat intelligence, attack graphs, asset context, and behavioral baselines into a unified knowledge graph
\n
• Research and deploy AI SOC platform capabilities: automated threat hunting, AI-assisted incident investigation, and natural language security query (SecOps Copilot)
\n
• Design detection scenarios from an attacker’s perspective, ensuring coverage of real APT TTPs (including Lazarus and other crypto-industry threat actors)
\n
• Research AI-assisted attack techniques (AI-generated payloads, automated reconnaissance, LLM-assisted social engineering) and proactively build corresponding detection capabilities
\n
• Track AI SOC frontier research (LLM for Security, AI Agent for SOC, Agentic Security Operations) and drive internal adoption
\n

Major Requirements

\n
• 3+ years of SOC/security operations or penetration testing experience with deep understanding of attack chains and defensive architectures
\n
• Proficient in major SIEM platforms (Splunk, Elastic etc.) and detection rule languages (SPL, KQL, Sigma)
\n
• Familiar with MITRE ATT&CK framework; able to map TTPs and design corresponding detection scenarios
\n
• Hands-on experience in alert investigation, incident response, or threat hunting
\n
• Strong Python engineering skills; able to independently develop AI-assisted security tools and automation scripts
\n
• Familiar with LLM application development (Prompt Engineering, RAG, Function Calling, AI Agent frameworks such as LangChain/AutoGen)
\n
• Practical experience applying AI/ML models to security use cases (alert classification, anomaly detection, NLP log analysis)
\n
• (Preferred) Experience designing or building AI SOC products or platforms (AI SOAR, SecOps Copilot, automated playbooks)
\n
• (Preferred) Familiarity with knowledge graphs and graph databases (Neo4j, etc.) in security contexts
\n
• (Preferred) Web3 / cryptocurrency security background (on-chain attack detection, exchange security operations)
\n
• (Preferred) Security certifications (OSCP, GCIA, GCIH, GREM) or public research contributions (CVE, conference talks, open-source tools)
\n