Sr. Security Engineer

We are looking for a senior (L3) security engineer / risk analyst — the deepest technical escalation point in the security team, handling the hardest investigations, engineering the toughest detections, and doing the risk analysis that others can't. This is a senior individual contributor whose work is defined by depth: the incidents that reach L3 are the ambiguous, high-stakes ones, and the detections they build are the ones that catch what everything else missed.

The defining shift for this seat in 2026 is that AI-specific threats now sit squarely inside the L3 remit. Security teams need people who can identify AI-specific threats such as prompt injection, model abuse, data leakage, and unsafe automation, while the emerging AI-security-engineer remit focuses on preventing and detecting threats like data poisoning, model theft, prompt injection, and insecure tool use in agents, integrated with standard application and cloud security. At the same time, LLM-integrated SIEM/SOAR hands even senior analysts summarized incident briefs, changing where deep human effort is spent.

The value this person brings is the deepest technical security capability on the team — the engineer who resolves what nobody else can, and who is already fluent in defending both with and against AI.

We are seeking a deep technical specialist — an L3 who is the last line of escalation, equally strong at engineering detections, running the hardest investigations, and reasoning about emerging risk. They are already thinking about AI-specific threats and using AI-integrated tooling with a critical eye.

This profile partners across the SOC, security engineering, application / cloud teams, and security leadership. It suits someone open to a hybrid engagement, and to mobilization to the Middle East, Europe, or North America depending on the client. The person we want is the technical authority others escalate to.

A strong candidate for this role has operated at L3 depth — someone who has handled the hardest escalated investigations, engineered high-value detections, and done risk analysis on complex or novel threats. They bring depth in both traditional security and the emerging AI-threat surface.

In practice, the responsibilities break down as follows:

• L3 investigation: Own the hardest escalated investigations and incidents; be the final technical escalation point.
• Advanced detection engineering: Build and tune high-value detections that catch what earlier tiers miss.
• Deep risk analysis: Analyze complex, novel, or high-stakes risks — including AI-specific threats such as prompt injection, model abuse, data leakage, and unsafe automation.
• AI-system security: Prevent and detect AI-specific threats (data poisoning, model theft, insecure tool use in agents), integrated with standard app and cloud security.
• AI-assisted depth work: Use LLM-integrated SIEM/SOAR to accelerate investigation, redirecting deep human effort to the ambiguous cases.

We want to see an L3 with exceptional technical depth in detection engineering, investigation, and risk analysis — and genuine fluency in the AI-threat surface, both defending with AI and securing AI systems. The strongest candidates are the technical authority on the team.

Core security engineering

• Advanced detection engineering, SIEM/SOAR, and deep incident investigation.
• Security frameworks (MITRE ATT&CK, NIST); identity, cloud (AWS, Azure, GCP or equivalent), and application security depth.
• Risk analysis of complex and novel threats.

Analysis performance (KPIs from research)

• Steers detection efficacy on hard cases, escalation-resolution depth, and false-negative reduction — as LLM tooling reshapes where deep effort goes.

Modern Agentic AI / AIOps (niche areas we are seeking — depth explored at interview)

• Detecting and defending AI-specific threats: prompt injection, model abuse, data poisoning, model theft, and insecure agent tool use;.
• LLM-integrated SIEM/SOAR for accelerated deep investigation.

This role is delivered through Solutions Chapter Group's Human Resources chapter (Chapter 12) as a Recruitment Process Outsourcing (RPO) engagement, under our Technical Recruitment stream. Rather than a "post-and-pray" marketplace approach, we use a Curated Professional Recruitment model: candidate profiles are pre-vetted in our internal database, and when a required profile isn't already available, our dedicated Scout network conducts global headhunting to secure it. We screen and match candidates against each client's specific requirements, and placements may be remote or an on-site deployment with mobilization to the Middle East, Europe, or the United States.

From a recruitment-fit perspective, we screen for:

• Exceptional technical security depth.
• Ability to resolve the hardest escalations.
• Advanced detection-engineering skill.
• Fluency in the AI-threat surface.
• Openness to the engagement model (remote or mobilized on-site) and readiness for cross-region deployment.

Areas to explore at interview *(topics only)*

• The hardest investigation you resolved
• A high-value detection you engineered