Principal Software Engineer - Agentic SOC
Huntress · USA
About this role
## Principal Software Engineer — Agentic SOC ### About Huntress Huntress is a remote-first cybersecurity company founded in 2015 by former NSA cyber operators. We build enterprise-grade security technology in-house and operate a **24/7 human-led Security Operations Center (SOC)**. Our platform helps protect **millions of endpoints and identities** worldwide. ### Role Overview Huntress is building an **Agentic SOC**: when the detection pipeline raises a signal, an **LLM-based agent** investigates end-to-end by: - Gathering telemetry across Huntress products - Reconstructing what happened - Producing a **well-documented** determination of whether activity is malicious This system is designed to **augment analysts, not replace them**—taking high-volume, repetitive work off their plates so they can focus on complex cases and hands-on intrusions where human expertise matters most. ### What You’ll Do - **Own the architecture** of agentic investigation (signal → investigation flow, state management, tool design/exposure, and what a finished investigation includes: verdict, timeline, scope, and evidence) - **Build agents that investigate like strong analysts** by translating analyst triage/investigation behavior into agent actions (questions to ask, evidence to gather, when to dig deeper, when to hand off) - **Reduce analyst toil** with LLM-powered pre-processing (summarize, correlate, highlight what matters) - **Design with a security mindset**: untrusted, attacker-influenced data; tenant isolation; auditability; trust boundaries - **Treat evaluation as a core product requirement** (measure correctness, reasoning quality, documentation quality; ensure changes are evidence-backed) - **Decide with data what the system does autonomously** vs. what requires human review - **Build for production**: reliability, latency, cost at scale, and traceability for decisions/actions - **Design agent→analyst handoff** so analysts are faster and better informed when they take over - **Prototype and derisk hard problems** before scaling approaches - **Represent the team technically** to SOC leadership, product, and engineering stakeholders; drive alignment and protect scope - **Lead with rigor and pragmatism** (push back on risky shortcuts; avoid unnecessary over-engineering) - **Raise the floor and ceiling** through code review, pairing, leverage via patterns/tooling, and team health feedback ### Responsibilities (Summary) - Own agentic investigation architecture - Build analyst-like investigation agents - Create LLM pre-processing to reduce toil - Ensure security, isolation, and auditability - Build evaluation and quality measurement for non-deterministic systems - Define autonomy levels and human handoff behavior - Deliver production-grade reliability and traceability ### What You Bring To The Team - **15+ years** building complex software products; significant technical lead experience on production systems - Hands-on experience designing and shipping **LLM-based agents in production** (tool use, context management, structured output, guardrails, evaluation) - Track record building **evaluation** for non-deterministic systems (labeled datasets, offline evals, regression gates; quality over time) - Security mindset: untrusted input, multi-tenant isolation, audit trails - Experience with automated decisions that have real consequences - Curiosity about how security analysts think and work - Deep backend expertise (distributed systems, queues, durable wo
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.