7 days ago
Bucharest, RomaniaSenior
Responsibilities
- Lead complex initiatives across security services teams and implement critical components using LLMs, agents, and retrieval pipelines.
- Define reusable architectures for agents, retrieval-augmented generation, and tool integrations.
- Establish evaluation methods and release criteria covering accuracy, reliability, false positives, and regressions.
- Design controls for least-privilege access, sensitive data, prompt injection, output validation, and analyst approval of high-impact actions.
- Lead integrations with SIEM, SOAR, XDR/EDR, threat intelligence, and case management systems.
- Improve shared Python components, testing, observability, resilience, CI/CD, and rollback practices.
- Own reliability and measurable outcomes across workflows, including investigation quality, analyst time saved, success rates, latency, and cost.
- Shape priorities with Security Operations, Threat Research, Data Science, and DevOps; resolve production issues and document architecture standards.
- Lead design reviews and coach engineers on complex implementation decisions.
Requirements
- 7+ years of experience building production software, including 2+ years with LLMs, agents, or applied ML.
- At least 1 year of experience in or alongside a SOC or security team.
- Deep Python and API engineering skills, with experience evaluating OpenAI, Anthropic, and open-source models for production use.
- Experience leading architecture and delivery across multiple workflows or services, with reusable designs adopted by other engineers.
- Experience defining AI evaluation and release criteria, diagnosing systemic failure modes, and balancing quality, security, latency, and cost.
- Strong security operations knowledge and experience designing secure integrations, evidence handling, and analyst oversight for automated response.
- Experience designing and operating distributed or event-driven cloud services, including testing, observability, resilience, and incident resolution.
- Ability to turn ambiguous needs into technical plans, influence cross-team decisions, and coach senior engineers while remaining hands-on.
- Preferred experience with SQL, Taegis, Sigma detection rules, MITRE ATT&CK, vector databases, hybrid retrieval, model fine-tuning, or agent orchestration frameworks.
- Preferred background in incident response, network traffic analysis, Windows event log analysis, containerized or event-driven services, or open-source security and ML tooling contributions.
Benefits
- Remote-first working model, with hybrid work required for some roles; applicants must have legal authorization to work in the posted jurisdiction without requiring employer sponsorship.
- Employee-led diversity and inclusion networks.
- Annual charity, fundraising, and volunteer days.
- Global sustainability initiatives.
- Global fitness and trivia competitions.
- Global wellbeing days, wellbeing webinars, and health training.
Categories
About Sophos
Sophos provides enterprise cybersecurity software and managed services covering endpoint, network, email, cloud security, XDR, and next-gen SIEM, plus 24/7 MDR. It sells to businesses through direct sales and a global channel of MSPs/MSSPs, resellers, and technology partners. Founded in 1985 and headquartered in Abingdon, Oxfordshire, the company was formerly listed on the London Stock Exchange and is now privately held under Thoma Bravo ownership.