Manager - AI & Automation

Overview

The Manager - AI & Automation is responsible for leading the design, development, deployment, governance, and continuous improvement of AI and automation capabilities within a multi-customer Managed Security Service Provider, or MSSP, Security Operations Center.

The role combines technical leadership, security operations, AI engineering, service management, customer engagement, and people management. The manager will lead a multidisciplinary team responsible for developing and operating AI agents, agentic workflows, security automation, SOAR playbooks, detection engineering solutions, and AI-assisted incident response capabilities.

The Role Has Two Primary Areas Of Focus

• AI for Security:
  Applying AI, agents, automation, orchestration, and machine learning to improve alert triage, investigation, threat hunting, detection engineering, incident response, reporting, and SOC efficiency.
• Security for AI:
  Protecting AI applications, agents, models, retrieval systems, APIs, tools, data, and supporting infrastructure against misuse, unauthorized access, data leakage, prompt injection, excessive agency, model manipulation, and supply-chain risks.

The manager is accountable for ensuring that AI-enabled SOC capabilities are secure, reliable, explainable, auditable, cost-effective, tenant-aware, and governed through appropriate Human-in-the-Loop and Human-on-the-Loop controls.

Responsibilities AI and Automation Service Leadership

• Translate the AI and automation strategy into roadmaps, engineering backlogs, delivery plans, and measurable outcomes.
• Manage the delivery and continuous improvement of AI agents, agentic workflows, integrations, SOAR playbooks, and security automation.
• Prioritize initiatives based on security value, customer impact, operational risk, analyst effort, scalability, complexity, and cost.

Vendor-Agnostic Agent Engineering

• Lead the architecture and hands-on development of enterprise-grade AI agents and agentic workflows for security operations.
• Build agents from scratch using a vendor-agnostic approach, avoiding unnecessary dependency on a single model provider, cloud platform, orchestration product, or security vendor.
• Design solutions that allow models, tools, data sources, prompts, and orchestration components to be replaced or upgraded with limited impact.
• Apply abstraction layers, standard interfaces, structured outputs, reusable tools, model gateways, and portable integration patterns.
• Evaluate and select agent development frameworks based on the use case, security requirements, maintainability, performance, licensing, and operational cost.
• Develop agents using common frameworks such as Agno, Lang Chain, Lang Graph, Google Agent Development Kit, OpenAI Agents SDK, and Mastra.
• Guide the design of single-agent and multi-agent architectures for triage, enrichment, investigation, threat hunting, detection engineering, case management, reporting, and response recommendations.
• Ensure agents preserve customer context, tenant boundaries, evidence traceability, and decision history.
• Integrate agents with SIEM, SOAR, EDR/XDR, NDR, cloud security, identity, email security, threat intelligence, vulnerability management, ITSM, and collaboration platforms.

Secure Development and Production Operations

• Establish secure development practices covering version control, peer review, automated testing, secrets management, CI/CD, staged deployment, change control, and rollback.
• Define evaluation criteria for accuracy, groundedness, consistency, evidence quality, tool selection, action success, latency, resilience, security, and cost.
• Ensure agents are tested against incomplete, ambiguous, conflicting, malicious, and customer-specific inputs.
• Implement production safeguards such as execution boundaries, approval gates, rate limits, timeouts, circuit breakers, kill switches.