Senior Security Application Engineer - Automation & Detection

Description

The company is a multibillion-dollar global memory maker headquartered in Rancho Cordova, California, with sites across Asia, Europe, and the Americas. It pairs the stability of an established firm with the agility of a start-up.

The role sits in the security team and covers two areas: detection and response engineering, and the product security and code signing platform that underpins firmware signing, device identity, attestation, and unlock across all product lines. You will work closely with firmware, CI/CD, manufacturing, and operations teams.

Responsibilities

• Set the detection coverage strategy, including detection standards, naming conventions, and quality criteria for the SOC and the product security program.
• Map the threat landscape to MITRE ATT&CK coverage and prioritize detection work based on real adversary behavior and threat intelligence.
• Maintain ATT&CK coverage heatmaps and track mean time to detect (MTTD) and false positive rates as operational KPIs.
• Own the full lifecycle of agentic detection and response, from threat use case through detections-as-code and automated triage to production agentic response workflows.
• Design and govern the lifecycle of non-human identities used by AI agents in the security environment, covering scoped delegation, audit logging, and kill-switch controls.
• Threat-model all agent deployments using MITRE ATLAS adversarial ML techniques, and test guardrails against the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic AI.
• Support and enhance the product security and code signing platform: firmware signing, device identity (EJBCA/PKI), attestation (COSE/CBOR, LMS, PQC/ML-DSA), and unlock (CRAM/ADU).
• Build and maintain automation in CI/CD for signing pipelines, HSM health monitoring, certificate lifecycle management, and access provisioning.
• Develop the automation and tooling that moves PQC adoption forward, including ML-DSA, LMS/LMOD, CNSA 2.0+, and OCP 3.0+ readiness.
• Own and evolve the security data platform for cryptographic governance, including signing telemetry, KPI dashboards, audit logging, and anomaly detection for signing infrastructure.
• Design AI agent integrations inside the signing and cryptographic operations environment, with scoped identity, delegation controls, and human oversight for any automation that touches signing or keys.
• Embed with firmware, CI/CD, and manufacturing teams to deliver security controls, pipeline integrations, and attestation automation in their environments.
• Integrate SAST, SBOM generation and validation, attestation signing, and supply-chain controls into firmware build and release pipelines.
• Test security controls through adversary emulation and purple team exercises, and close the coverage gaps they reveal.
• Work within the governance gates of NIST AI RMF, OWASP Top 10 for LLM Applications, NIST FIPS 140-3, NSA CNSA 2.0+, OCP 2.5 to 3.0+, and ISO 27001/SOX ITGC.
• Define detection, automation, and cryptographic governance standards and lead the security program components you own.
• Shape the product and application security roadmap through threat modeling, control design, and input to the Cryptographic Architecture Board.
• Act as the first point of contact for cross-team security engineering projects and align technical outcomes with business needs across firmware, manufacturing, and operations.
• Mentor MSP analysts, junior security engineers, and firmware engineers on agentic patterns, detection practice, and cryptographic operational hygiene.
• Promote TDD, security-by-design, a sound balance of tech debt, and agile practices within and beyond the security team, and hold your own output to a high standard.
• Agree priorities, roadmap, and resource allocation with Engineering Managers and the Product & App Security Lead.
• Build supervised automations that take routine L1 work off analysts and operators, lowering cost-to-serve while keeping the company in control and in view.
• Write and maintain runbooks, training materials, and knowledge documentation to reduce reliance on single individuals.
• Take part in daily ops standups, weekly and monthly governance rhythms, KPI reporting, quarterly CISO reviews, and the Cryptographic Architecture Board.

Requirements

• A B.S. degree in Information Security, Cybersecurity, Computer Science, Software Engineering, or a related field.
• Advanced English (mandatory).
• 4-6+ years of relevant hands-on experience in software development, with Python preferred, plus API integration, infrastructure-as-code, and CI/CD pipeline development.
• Detection engineering experience and SIEM/SOAR work on Microsoft Sentinel and/or Splunk, including incident response workflows, with comfort owning the detection lifecycle end to end.
• Working knowledge of MITRE ATT&CK, including TTP mapping, kill chain coverage analysis, detection-to-technique alignment, and building coverage heatmaps and reporting gaps.
• Working knowledge of MITRE ATLAS for adversarial ML threat modeling of AI systems and agents, covering model evasion, data poisoning, prompt injection, AI supply-chain compromise, and agent-specific attack vectors.
• Hands-on experience building production agent systems with agent frameworks, RAG pipelines, or agentic orchestration.
• Knowledge of AI security governance: NIST AI RMF, OWASP Top 10 for LLM Applications (LLM01 to LLM10), OWASP Top 10 for Agentic AI, and control design for guardrails, human oversight, and secure orchestration.
• Working knowledge of cryptography and PKI: HSM operations, certificate lifecycle management, code signing pipelines, CA hierarchies, certificate policies, and key management.
• Proven ability to lead technical decisions in your own domain, influence adjacent domains, and align technical outcomes with business requirements (IC7 Communication & Leadership standard).
• Comfort embedding with operational and engineering teams, shipping in partner-controlled environments, and coaching people across technical levels.
• Preferred: hands-on work with HSM platforms such as Entrust nShield, Fortanix DSM, or similar, including HSM cluster operations, ACS card lifecycle, and key import/export workflows.
• Preferred: PKI and certificate management with EJBCA/KeyFactor, Venafi, or similar, including manufacturing device identity injection, MTKI/sub-CA hierarchies, and certificate expiry management.
• Preferred: code signing pipeline experience with firmware or binary signing (COSE/CBOR, Authenticode, or similar), SBOM generation and signing, and attestation workflows.
• Preferred: practical post-quantum cryptography experience with ML-DSA, LMS/LMOD, or hybrid schemes, and familiarity with CNSA 2.0+ and NIST PQC standards.
• Preferred: experience with compliance frameworks: NIST FIPS 140-3, NSA CNSA 2.0+, OCP 2.5/3.0+, ISO 27001, and SOX ITGC.
• Preferred: Microsoft security stack experience with Defender XDR, Microsoft Sentinel (including Data Lake), Security Copilot, Logic Apps, KQL, and Azure.
• Preferred: Splunk experience with SPL, log forwarding, content and detection management, and index administration.
• Preferred: agentic tooling experience with Model Context Protocol (MCP), Security Copilot plugins, LangChain, or similar security-native orchestration and connector frameworks.
• Preferred: non-human and workload identity experience with Entra Workload Identities, Okta, or similar, including service principal and managed identity lifecycle management.
• Preferred: a prior forward-deployed, solutions engineering, detection engineering, or product security role in an enterprise manufacturing or hardware environment.