About the Role

Build the AI that powers Dark Star. You'll use AWS agentic technology — Amazon Bedrock and Bedrock AgentCore — to design, deploy, and operate AI agents that integrate with our clients' security products and autonomously pick up, investigate, and respond to security incidents with high fidelity, under analyst supervision. This role sits at the intersection of cloud engineering, applied AI, and security operations — and you'll need real depth in all three.

What You'll Do

• Design and build agentic AI workflows on Amazon Bedrock and AgentCore that autonomously triage, investigate, and respond to security incidents end-to-end
• Integrate agents with client security stacks — SIEM, EDR/XDR, identity, email, and cloud platforms (Microsoft Sentinel, Defender, CrowdStrike, Splunk, Entra ID and more) — through robust API integrations
• Engineer for high fidelity: grounding, guardrails, evaluation harnesses, and confidence thresholds that minimize false actions before an agent ever touches a client environment
• Build the safety layer — human-in-the-loop approval gates, full audit logging, and reversible actions for every automated response
• Own the reliability, performance, security, and cost of agent infrastructure in AWS (IAM, Lambda, Step Functions, EventBridge, ECS/EKS)
• Partner with SOC analysts to turn incident-response playbooks into automation, and iterate on agent behavior from real incident outcomes
• Track the agentic AI and adversarial-ML landscape — prompt injection, tool-abuse, and model risks — and harden our agents against it

What You'll Bring

• 5+ years of combined cloud, security, and software engineering experience, with production AWS depth (IAM, Lambda, Step Functions, EventBridge, containers)
• Hands-on experience building with Amazon Bedrock and agent frameworks (Bedrock Agents / AgentCore, LangGraph, or comparable) in production
• Real security-operations grounding: incident response, SOC/SIEM workflows, detection logic, and MITRE ATT&CK
• Strong Python (and/or TypeScript) with a track record of API-heavy integrations against security tooling
• Applied LLM engineering: tool use / function calling, RAG, guardrails, and evaluation of agent accuracy
• Cloud security fundamentals — least-privilege design, secrets management, network isolation

Nice to Have

• AWS certifications (Security – Specialty, Solutions Architect, or Machine Learning)
• Security certifications (GCIH, GCIA, OSCP, or CISSP)
• SOAR experience (XSOAR, Sentinel playbooks, Tines) you can compare honestly against agentic approaches
• Prior MDR/MSSP or multi-tenant SOC environment experience