AI and Automation Engineer
New
S
SophosCybersecurity
Location: Canada; Workplace: RemoteFull-TimeSenior
SalaryIn Canada, the base salary for this role ranges from $86,000 to $143,000. In addition to base salary, we offer additional compensation including bonus eligibility.
Apply NowOpens the employer's application page
Job Details
- Experience
- 5+ years building production software, including 1+ year with LLMs, agents, or applied ML; 1+ year in or alongside a SOC or security team.
- Required Skills
- PythonGitCI/CDRESTful APIsJSON
Requirements
- Have 5+ years of experience building production software.
- Have 1+ year of experience with LLMs, agents, or applied ML.
- Have 1+ year of experience in or alongside a SOC or security team.
- Demonstrate strong Python, REST API, and JSON skills.
- Have experience with OpenAI, Anthropic, or open-source models.
- Have independently delivered complex retrieval pipelines, evaluation frameworks, or agent workflows from design into production.
- Be able to evaluate AI quality with noisy or incomplete labels, investigate failure modes, and explain model and retrieval tradeoffs.
- Have experience integrating security platforms, handling telemetry securely, and applying SOC triage, investigation, and incident response concepts.
- Have hands-on experience with Git, automated testing, CI/CD, cloud deployment, and production troubleshooting in AWS, Azure, GCP, or a comparable environment.
- Have experience with SQL, Taegis, Sigma detection rules, or mapping detections to MITRE ATT&CK.
- Experience with vector databases, hybrid retrieval, model fine-tuning, or agent orchestration frameworks is listed.
- Background in incident response, network traffic analysis, or Windows event log analysis is listed.
Responsibilities
- Deliver automation for security service use cases, translating service needs into implementation plans.
- Design agent workflows and retrieval-augmented generation pipelines grounded in security telemetry, threat intelligence, and analyst runbooks.
- Integrate SIEM, SOAR, XDR/EDR, threat intelligence, and case management tools using secure REST APIs and event-driven interfaces.
- Define evaluation criteria and test factual accuracy, missed threats, false positives, and regressions before releasing changes.
- Implement least-privilege access, sensitive-data controls, output validation, and analyst approval for high-impact actions.
- Test workflows for resistance to prompt injection from untrusted telemetry.
- Ship tested Python services through code review and CI/CD, and own monitoring, troubleshooting, failure handling, and rollback.
- Measure quality, effort reduction, workflow success, latency, and cost; use production evidence and user feedback to prioritize improvements.
- Coordinate delivery with Security Operations, Threat Research, Data Science, and DevOps; document designs and runbooks and mentor engineers through reviews and pairing.
View Full Description & ApplyYou'll be redirected to the employer's site
