Lead Cybersecurity - Insider Risk Engineer

This position requires office presence of a minimum of 5 days per week and is only located in the location(s) posted. No relocation is offered.

Join AT&T and help shape the future of communications and technology that connect the world. We value innovators who seek to explore the unknown and challenge the status quo. Bring your bold ideas and fearless spirit to redefine connectivity and transform how people share stories and experiences. At AT&T, you won’t just imagine the future—you’ll build it.

The Insider Risk AI Engineer supports the design, development, and deployment of AI‑enabled solutions that improve security operations and business workflows. This role focuses on building and iterating AI/ML and GenAI components (data prep, prompt/workflow design, evaluation, and lightweight model development), partnering with senior engineers, product owners, and operational teams to move prototypes into reliable services.

• Build AI prototypes and small services that solve defined problems (e.g., text classification, summarization, routing, search, Q&A, extraction).
• Develop and maintain data pipelines for AI use cases (collect, clean, label, transform) using approved data sources.
• Create and iterate on LLM prompts, agent/workflow logic, and retrieval‑augmented generation (RAG) patterns for internal knowledge use cases.
• Implement evaluation methods for AI outputs (quality, groundedness, hallucination checks, latency, cost) and report results.
• Support model lifecycle tasks: experiment tracking, versioning, basic MLOps (packaging, deployment, monitoring).
• Assist in integrating AI components into existing applications via APIs and lightweight UI or automation.
• Document solutions (design notes, datasets, prompt versions, test cases) and contribute to internal reusable components.
• Collaborate with stakeholders to define success metrics, acceptance criteria, and guardrails for AI‑enabled features.

• Summarize tickets/incidents into standardized notes and action items.
• Auto‑tag and route requests based on description content.
• Extract entities and indicators from unstructured text (emails, logs, reports).
• Build an internal knowledge assistant over approved documentation with citations.
• Generate draft playbooks/runbooks from templates and curated inputs.

• 0–2 years of experience in software engineering, data engineering, analytics, or applied ML (internships/academic projects welcome).
• Strong fundamentals in Python.
• Working knowledge of data structures, APIs, and basic software engineering practices (testing, code reviews, Git).
• Data handling with pandas/SQL.
• ML basics (train/test splits, overfitting, common metrics) and/or LLM application patterns.
• Familiarity with at least one AI/ML framework or platform (PyTorch, Tensor Flow, scikit‑learn, or common LLM tooling).
• Ability to write clear documentation and communicate tradeoffs (quality vs cost vs latency).

• Experience with GenAI application development patterns: RAG (embeddings, vector databases, chunking strategies), prompt engineering and prompt versioning, tool/function calling and agentic workflows, output evaluation and red‑teaming basics (prompt injection awareness, safety filters).
• Exposure to MLOps concepts: CI/CD for ML, model registry, feature stores, monitoring/drift.
• Experience with cloud services (any of AWS/Azure/GCP) and containerization (Docker).
• Basic understanding of privacy/security fundamentals for AI systems (data handling, access controls, logging).

• Experience partnering with or supporting a SOC (e.g., translating analyst workflows into automations, alert triage enrichment, case summarization).
• Familiarity with SIEM/EDR concepts and data (e.g., Splunk/Sentinel‑like searches, endpoint telemetry, detection event schemas) to build AI features on top of security telemetry.
• Exposure to threat intelligence & IOC handling (IPs/domains/URLs/hashes) and using AI to extract/normalize indicators from unstructured text.
• Working knowledge of incident response lifecycle and case management…