Overview: The Manager - AI & Automation is responsible for leading the design, development, deployment, governance, and continuous improvement of AI and automation capabilities within a multi-customer Managed Security Service Provider, or MSSP, Security Operations Center.
The role combines technical leadership, security operations, AI engineering, service management, customer engagement, and people management. The manager will lead a multidisciplinary team responsible for developing and operating AI agents, agentic workflows, security automation, SOAR playbooks, detection engineering solutions, and AI-assisted incident response capabilities.
The role has two primary areas of focus:
- AI for Security: Applying AI, agents, automation, orchestration, and machine learning to improve alert triage, investigation, threat hunting, detection engineering, incident response, reporting, and SOC efficiency.
- Security for AI: Protecting AI applications, agents, models, retrieval systems, APIs, tools, data, and supporting infrastructure against misuse, unauthorized access, data leakage, prompt injection, excessive agency, model manipulation, and supply-chain risks.
The manager is accountable for ensuring that AI-enabled SOC capabilities are secure, reliable, explainable, auditable, cost-effective, tenant-aware, and governed through appropriate Human-in-the-Loop and Human-on-the-Loop controls.
Responsibilities: AI and Automation Service Leadership - Translate the AI and automation strategy into roadmaps, engineering backlogs, delivery plans, and measurable outcomes.
- Manage the delivery and continuous improvement of AI agents, agentic workflows, integrations, SOAR playbooks, and security automation.
- Prioritize initiatives based on security value, customer impact, operational risk, analyst effort, scalability, complexity, and cost.
Vendor-Agnostic Agent Engineering - Lead the architecture and hands-on development of enterprise-grade AI agents and agentic workflows for security operations.
- Build agents from scratch using a vendor-agnostic approach, avoiding unnecessary dependency on a single model provider, cloud platform, orchestration product, or security vendor.
- Design solutions that allow models, tools, data sources, prompts, and orchestration components to be replaced or upgraded with limited impact.
- Apply abstraction layers, standard interfaces, structured outputs, reusable tools, model gateways, and portable integration patterns.
- Evaluate and select agent development frameworks based on the use case, security requirements, maintainability, performance, licensing, and operational cost.
- Develop agents using common frameworks such as Agno, LangChain, LangGraph, Google Agent Development Kit, OpenAI Agents SDK, and Mastra .
- Guide the design of single-agent and multi-agent architectures for triage, enrichment, investigation, threat hunting, detection engineering, case management, reporting, and response recommendations.
- Ensure agents preserve customer context, tenant boundaries, evidence traceability, and decision history.
- Integrate agents with SIEM, SOAR, EDR/XDR, NDR, cloud security, identity, email security, threat intelligence, vulnerability management, ITSM, and collaboration platforms.
Secure Development and Production Operations - Establish secure development practices covering version control, peer review, automated testing, secrets management, CI/CD, staged deployment, change control, and rollback.
- Define evaluation criteria for accuracy, groundedness, consistency, evidence quality, tool selection, action success, latency, resilience, security, and cost.
- Ensure agents are tested against incomplete, ambiguous, conflicting, malicious, and customer-specific inputs.
- Implement production safeguards such as execution boundaries, approval gates, rate limits, timeouts, circuit breakers, kill switches.
#J-18808-Ljbffr