Title: Cyber Security AI Engineer, Security Operations Center (SOC)
Location: Atlanta, GA
Overview
The Cyber Security AI Engineer is a member of the Global Information Security team responsible for designing, developing, and operationalizing AI-driven cybersecurity capabilities that enhance Security Operations Center (SOC) effectiveness. This role combines expertise in cybersecurity, threat detection, automation, data science, machine learning, and security engineering to improve the organization's ability to identify, investigate, and respond to cyber threats at scale.
The Cyber Security AI Engineer will partner closely with Threat Intelligence, Incident Response, Security Engineering, Detection Engineering, and IT Operations teams to develop intelligent detection models, automate security workflows, improve investigations through AI-assisted analytics, and create scalable solutions that reduce analyst workload while increasing detection accuracy.
This role supports the organization's mission to protect the confidentiality, integrity, and availability of information assets through innovative use of artificial intelligence, machine learning, automation, and advanced analytics.
Key Responsibilities
AI-Driven Security Operations
- Design, develop, and maintain AI and machine learning solutions to improve threat detection, incident triage, and security investigations.
- Build predictive models to identify malicious activity, anomalous user behavior, insider threats, and emerging attack patterns.
- Develop and operationalize AI-assisted threat hunting capabilities across enterprise environments.
- Integrate Large Language Models (LLMs), Generative AI, and advanced analytics into SOC workflows to accelerate investigations and response activities.
- Create AI-powered copilots to assist analysts with investigation, enrichment, summarization, and incident response recommendations.
Incident Response Support
- Support investigation and response efforts for cybersecurity incidents.
- Leverage AI analytics to accelerate root cause analysis and incident containment.
- Assist incident responders with automated evidence gathering and forensic data analysis.
- Participate in major incident investigations and contribute to post-incident reviews.
Security Detection Engineering
- Develop and optimize detection logic using SIEM, XDR, EDR, cloud security, and log analytics platforms.
- Build automated detection pipelines leveraging threat intelligence, MITRE ATT&CK mappings, and behavioral analytics.
- Create AI-generated detection rules and continuously validate detection effectiveness.
- Develop methods to reduce false positives and improve alert prioritization using machine learning techniques.
Threat Intelligence & Threat Hunting
- Utilize internal and external threat intelligence sources to train and improve detection models.
- Conduct proactive threat hunting exercises utilizing AI-enhanced analytics and behavioral indicators.
- Develop automated intelligence ingestion, correlation, and enrichment processes.
- Translate intelligence findings into actionable detection and response capabilities.
Security Automation & Orchestration
- Design and implement security automation using SOAR platforms, APIs, scripting, and AI workflows.
- Automate repetitive SOC tasks including alert enrichment, triage, investigation, reporting, and containment recommendations.
- Develop integrations between AI tools, SIEM platforms, threat intelligence systems, and case management tools.
- Improve SOC operational efficiency through continuous process optimization and automation.
Required Qualifications
Technical Skills- 0-4 years of experience in Cybersecurity, Security Operations, IT Support, Systems Administration, Network Administration, Incident Response, or a related technical field.
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related discipline, or equivalent practical experience.
- Basic understanding of cybersecurity principles, security monitoring, and incident response processes.
- Exposure to SIEM technologies such as Microsoft Sentinel, Splunk, QRadar, Elastic, or similar platforms through professional experience, internships, labs, or academic projects.
- Exposure to endpoint security technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or similar solutions.
- Basic scripting or programming skills in Python, PowerShell, SQL, or comparable languages.
- Familiarity with APIs, automation concepts, or workflow development.
- Interest in leveraging automation, analytics, artificial intelligence, and machine learning to improve cybersecurity operations.
- Strong analytical, troubleshooting, and problem-solving skills.
- Excellent communication skills and ability to work collaboratively across teams.
Cybersecurity KnowledgeWorking knowledge or exposure to:
- Security Operations Center (SOC) concepts
- Incident Response fundamentals
- Threat Detection and Monitoring
- Threat Intelligence concepts
- MITRE ATT&CK Framework
- NIST Cybersecurity Framework
- Cloud security fundamentals (Azure, AWS, or GCP)
- Identity and Access Management (IAM)
- Vulnerability Management
- Common cybersecurity threats, attack techniques, and defensive controls
Preferred Qualifications- Up to 3 years of experience supporting cybersecurity operations, security engineering, or security monitoring functions.
- Experience through work, internships, home labs, military service, certifications, or academic projects involving cybersecurity tools and technologies.
- Exposure to Microsoft security technologies, including Microsoft Sentinel, Defender, Security Copilot, or Azure security services.
- Familiarity with SOAR platforms and security automation concepts.
- Exposure to AI, machine learning, large language models, or generative AI technologies through projects, coursework, or professional experience.
- Experience developing scripts, automations, dashboards, or reporting solutions.
- Knowledge of cloud platforms such as Azure, AWS, or Google Cloud.
- Demonstrated curiosity and willingness to learn emerging security and AI technologies.
Preferred Certifications- CompTIA Security+
- Microsoft SC-900: Security, Compliance, and Identity Fundamentals
- Microsoft AZ-900: Azure Fundamentals
- Microsoft AI-900: AI Fundamentals
- Microsoft SC-200: Security Operations Analyst Associate
- Splunk Core Certified User
- ISC2 Certified in Cybersecurity (CC)
Offers of employment are conditional upon passage of screening criteria applicable to the job
