Principal Engineer - Agentic Security Operations; remote

Join a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people‑first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For list for eleven consecutive years.

We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit

Our Security Operations Center (SOC) protects the enterprise by detecting, investigating, and responding to cybersecurity threats. As a member of our Threat Detection Engineering team operating within our SOC, you will build governed agent capabilities to support data onboarding, detection engineering, threat hunting, investigation, response, automation, and platform operations. Our goal is to expand threat visibility, accelerate security outcomes, reduce repetitive work, and improve operational consistency and resilience without compromising sound security judgment, human accountability, or control.

The Principal Engineer provides hands‑on technical leadership to turn this strategy into secure, reliable, and supportable production capabilities across the SOC.
* We are open to remote candidates for this role

Lead the architecture and hands‑on implementation of Agentic Security Operations capabilities across the SOC. Define and evolve the reference architecture for governed data services, agent capabilities, workload routing, execution environments, and deterministic orchestration. Build reusable capabilities that translate operational intent into tested, reviewable, and auditable security outcomes. Establish engineering standards for creating, testing, registering, approving, releasing, monitoring, and retiring agents and their capabilities.

Advance detection‑as‑code practices, including versioning, simulation, deployment, tuning, migration, and rollback. Build governed knowledge and context services that provide authoritative documentation, policies, operational history, citations, freshness information, and permission‑aware retrieval. Design workload identity, least‑privilege access, short‑lived authorization, spend controls, approval gates, audit trails, rollback, and emergency shutdown mechanisms. Define autonomy levels that determine which activities may execute automatically, require human approval, or remain analyst‑led.

Establish agent evaluation and observability through historical replay, synthetic scenarios, expected‑versus‑actual comparisons, policy tests, traces, outcome verification, and regression testing. Measure quality, security, reliability, latency, cost, analyst acceptance, and operational impact. Engineer reliable integrations across search, case management, workflow, communications, and response systems, including retries, idempotency, partial failures, and reconciliation. Ensure consequential response actions remain deterministic, attributable, reversible, and subject to appropriate human oversight.

Design production reliability, continuity, recovery, and support models for agent capabilities and security data services. Lead proofs of concept and architecture evaluations using measurable criteria for security, fidelity, scale, reliability, portability, operating effort, and economic value. Collaborate with enterprise architecture, infrastructure, data, risk,…