Note: The job is a remote job and is open to candidates in USA. Abnormal AI is seeking a Senior Cyber Security Engineer to build and scale security capabilities across its primarily AWS-based cloud environment. The role leads security architecture, threat modeling, preventative and detective controls, AI-assisted automation, security tooling integrations, and incident response while mentoring engineers and serving as a cross-functional technical lead.
Responsibilities
- Lead threat modeling and security design discussions with both platform and product teams, translating risks into engineering actions and using AI to rapidly stress-test designs against attack scenarios before committing engineering time to a direction
- Partner with product engineering to review the security architecture of new product features — assessing designs for data exposure, access control, and abuse-case risk before they ship — using AI to speed up first-pass analysis so your review time goes toward the highest-risk decisions
- Collaborate with Platform, Infra, and DevOps teams to build scalable preventative controls in AWS via Infrastructure-as-Code — using AI coding agents to scaffold and iterate on Terraform/CloudFormation modules, reserving your own time for least-privilege review, blast-radius analysis, and edge cases
- Evaluate and uplift security tooling across commercial, cloud-native, and AI-assisted capabilities, focusing on scale, efficiency, and precision
- Mentor engineers on how to get real leverage from AI — reviewing AI-generated code and infrastructure together, and turning recurring feedback into standards and reusable playbooks instead of repeating it review after review
- Use AI to rapidly prototype automation for signal correlation, alert enrichment, and auto-remediation of known failure patterns, then harden and productionize what proves out rather than hand-building every workflow from a blank file
- Architect, build, and validate integrations between AWS and other cloud-native infrastructure and security tooling (e.g., SIEM, SOAR, IAM tooling), with a growing share of first-draft code AI-generated and human-owned
- Serve as a hands-on technical contributor during security incidents, using AI to accelerate log and telemetry triage while owning the judgment calls that determine root cause and response
- Build and maintain reusable AI-assisted playbooks (for IaC security review, detection authoring, alert triage) that scale your judgment across the security and platform teams
Skills
- * An intellectually curious, solution-focused engineer with a security mindset who thrives in fast-paced environments
- * A technical leader who can architect scalable security solutions while maintaining engineering velocity — increasingly by directing AI to do the first draft and applying judgment to the result
- * Someone who thinks like an attacker but builds like a defender, and who treats AI-generated infrastructure and detection logic with the same scrutiny as a junior engineer's first PR
- * Someone with high agency who proactively spots what in their own workflow (and the team's) AI can absorb, and actually builds the automation to make that real — not someone waiting to be told
- * A collaborative engineer who can translate security requirements into actionable engineering tasks
- * A mentor who scales their judgment across the team — reviewing AI-generated code and infra for security gaps, and encoding what they learn into reusable playbooks and standards rather than repeating the same feedback one engineer at a time
- * Proven delivery in security engineering or infrastructure security roles, ideally in cloud-native environments
- * Deep comprehension of native AWS architecture services and identity/access patterns — IAM, STS, cross-account roles and resource policies, VPC and network segmentation, KMS — with AWS as our primary cloud platform, plus working knowledge of Azure and GCP
- * Strong scripting and dev fundamentals in Python and/or Go — enough to read, critique, and confidently modify AI-generated code, not just prompt for it; proficiency with Git, Linux, and infrastructure automation patterns
- * Demonstrated fluency directing AI coding/agent tools (e.g., Claude Code, Cursor, Copilot) to accelerate delivery, paired with the judgment to catch when AI-generated infrastructure or security logic is wrong, incomplete, or dangerous
- * Expertise in integrating or building tooling for SIEM, SOAR, vulnerability management, and CSPM platforms
- * Experience deploying security controls via Infrastructure-as-Code (Terraform or CloudFormation), primarily in AWS
- * Comfortable investigating logs, tracing events, and contributing to incident analysis workflows
- * Proven ability to influence and collaborate cross-functionally with engineering, infra, product, and IT
- * Strong written communication and documentation skills and being able to convey complex designs clearly
- * Background with using and securing container orchestration (Kubernetes), including workload security and service mesh controls
- * Partner with cloud infrastructure teams to implement and maintain security controls across AWS accounts and services
- * Experience working in fast-paced or startup environments with sometimes ambiguous ownership lines
- * Experience building or operating agentic workflows/AI tooling for security use cases (detection authoring, alert triage, IaC generation/review)
- * Familiarity with JavaScript or TypeScript, particularly in the context of DevOps tooling or plugins
- * Hands-on experience with commercial Cloud Security tools (CNAPP, CSPM, DSPM, KSPM)
- * Prior experience building security telemetry pipelines or log correlation frameworks
- * Exposure to compliance frameworks (SOC 2, ISO 27001) and how engineering decisions affect auditability
- * Familiarity with CI/CD systems and integrating security checks into developer workflows
Benefits
- This role may be eligible for bonus or incentive compensation.
- This role may be eligible for equity.
- A comprehensive benefits package.
Company Overview
Company H1B Sponsorship