Security Technical Lead - AI SOC

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture  are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

The Security Technical Lead - AI SOC is a production security engineer who works embedded with customer security and engineering teams to make security operations more effective, measurable, and resilient. This role owns outcomes across assessment, design, build, deployment, optimization, and operational handoff.

The primary profile is a security engineer with meaningful AI experience. You should understand how security controls operate in production, how telemetry becomes detection and response, and how to reduce risk across complex enterprise environments. You will use AI and automation to strengthen those outcomes: improving detection quality, accelerating investigations, automating response, and helping customers securely govern and operate AI systems.

This is not a theoretical AI research role or a compliance-only position. It is a hands-on engineering role requiring the ability to design, build, integrate, troubleshoot, and operate security solutions in real customer environments. AI-assisted development tools such as Claude Code, Cursor, Git Hub Copilot, or similar tools may be part of your standard delivery practice for building security tooling, detection content, automation, and governance capabilities.

Embedded Security Engineering and Delivery

• Work hand-in-hand with customer security, engineering, platform, and infrastructure teams to deliver production-ready security outcomes.
• Serve as the technical lead for security engineering engagements from discovery and assessment through hardened deployment and optimization.
• Assess security posture, operational requirements, business objectives, and existing tooling; identify gaps and define pragmatic improvement roadmaps.
• Translate business, operational, compliance, and security requirements into secure architectures, implementation plans, and measurable outcomes.
• Own delivery outcomes, identify blockers early, and drive execution across customer, AHEAD, and partner teams.
• Lead architecture design sessions, threat modeling workshops, implementation reviews, and hands-on working sessions with customer technical and security leaders.
• Communicate security risk in business terms, translating threat exposure and operational gaps into clear, risk-adjusted recommendations.
• Act as a trusted advisor during onboarding, implementation, rollout, operational handoff, and continuous improvement.

Security Operations, Detection, and Response

• Design and implement integrations across SIEM, XDR, SOAR, case management, threat intelligence, identity, endpoint, cloud, network, and application security platforms.
• Build and operate security telemetry pipelines, including ingestion, normalization, enrichment, routing, retention, and access controls.
• Partner with SOC and detection engineering teams to improve detection coverage, alert quality, investigation workflows, threat hunting, and incident response.
• Define, develop, test, deploy, tune, and retire detections across SIEM, XDR, and security analytics platforms using queries, correlation rules, behavioral analytics, and threat-informed techniques.
• Translate threat intelligence, incident learnings, threat hunts, and MITRE ATT&CK techniques into prioritized detection use cases and measurable coverage improvements.
• Validate detection logic through representative test data, event replay, purple-team exercises, adversary emulation, and production outcomes; monitor false positives, false negatives, alert fidelity, and analyst effort