Security Engineer at CipherData

Job description

Security Engineer Bellevue, WA Security Engineering Full-time Posted Jul 1, 2026 Apply Now → About CipherData CipherData is building the AI-Native Detection and Response (AIDR) platform — a unified platform that delivers continuous risk reduction through SIEM-less detection and closed-loop autonomous response. Legacy SOC tools bolt AI copilots onto outdated architecture. AIDR redefines the entire SOC workflow, much as vibe coding is redefining the traditional SDLC: it autonomously investigates every alert within 5 minutes and delivers 24/7 coverage at the cost of a single analyst. SOC teams stop chasing alerts and start calling the shots. We are a seed-stage company headquartered in Bellevue, WA, with a subsidiary in Seoul. The team is small and senior — engineers and researchers from Meta, Google DeepMind, Amazon, Microsoft, and Samsung — and AIDR is already deployed with early enterprise customers. About the Role AIDR's agents investigate every alert autonomously. Your job is to make sure they investigate the right things, the right way. You will build the detection and correlation content our agents reason over, label the real investigations that tell us whether their conclusions are correct, and work inside customer SOCs while AIDR runs in production. This is a product role, not a corporate security or compliance role. You are joining our founding security team — you will work directly with the AI engineering team and with the engineer who leads our security function, and you will see your detection work go from idea to customer environment in days. We will level this role to the person: a strong engineer with a few years of hands-on SOC or detection work will grow fast here; a senior engineer will own large pieces outright. What You'll Do • Detection and correlation engineering: Write, test, tune, and retire the detection logic and correlation rules that turn multi-vendor security data into signal our agents can reason over. • Ground truth: Label real investigations into the benchmark datasets that measure whether agent output is right; find and document the cases where it is confidently wrong. • Threat research: Track attacker tradecraft and turn it into detection content, test cases, and agent capability. • Security lakehouse: Contribute to normalization, enrichment, and query patterns on our SIEM-less security lakehouse as we expand it. • Customer SOC work: Help deploy, tune, and validate AIDR in customer environments and carry analyst feedback back into detection and evaluation. • Incident response: Participate in customer-reported and internal incident response, including analysis, documentation, and post-incident review. Our Core Values Five principles guide every decision at CipherData. We hire against them and evaluate against them: • Trustworthiness — be trustworthy to all people. Integrity, transparency, and dependability with colleagues, partners, and customers. • Growth Mindset — learn from anything, anyone, anytime. Past experience is data, not dogma. Curiosity over ego; first principles over status quo. • Proactive Ownership — do the right thing for the customer. Customer first, then company, then team, then self. Step beyond your role and hold yourself accountable. • Disagree and Commit — debate when it matters, execute with unity. Challenge high-impact decisions with data and conviction, regardless of title. Once decided, commit fully. • Impact-Driven Execution — ship, learn, iterate. Move fast, take calculated risks, and measure yourself by outcomes, not activity. Minimum Qualifications • 3+ years hands-on in a SOC, detection engineering, threat hunting, or incident response role • You have written and tuned detections in production and can explain the false-positive trade-offs you made • Working experience with at least one SIEM or security data platform and EDR/XDR telemetry • Working Python; comfortable in a codebase with code review, tests, and CI • Comfort with ambiguity and ownership at an early-stage startup: you scope your own work, ask for help early, and ship Preferred Qualifications • 5+ years, including senior-level detection engineering or IR (we will level and title accordingly — Senior Security Engineer) • Detection-as-code practice • Cloud and identity telemetry depth • Experience building labeled datasets or evaluations • Familiarity with LLM-based systems and their failure modes • Purple team, adversary emulation, or offensive security background Details • Position: Security Engineer / Senior Security Engineer, Detection & Response (leveled to experience) • Experience: 3+ years • Employment type: Full-time • Location: Bellevue, WA CipherData is an equal opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other protected characteristic. CipherData · careers@cipherdata.ai Ready to apply? Ready to apply? Applications are handled through our external careers portal. Click below to submit your application for this role — we read every one and reply within a week. Apply Now → View all positions Cookie settings We use analytics cookies to understand how the site is used. Essential cookies keep it working. Read our Cookie Policy . Reject Accept

Requirements

Must-haves

Security Engineer
Bellevue, WA
Security Engineering
Posted Jul 1, 2026
Detection and correlation engineering: Write, test, tune, and retire the detection logic and correlation rules that turn multi-vendor security data into signal our agents can reason over.
Ground truth: Label real investigations into the benchmark datasets that measure whether agent output is right; find and document the cases where it is confidently wrong.
Threat research: Track attacker tradecraft and turn it into detection content, test cases, and agent capability.
Security lakehouse: Contribute to normalization, enrichment, and query patterns on our SIEM-less security lakehouse as we expand it.
Customer SOC work: Help deploy, tune, and validate AIDR in customer environments and carry analyst feedback back into detection and evaluation.
Incident response: Participate in customer-reported and internal incident response, including analysis, documentation, and post-incident review.
Our Core Values
Five principles guide every decision at CipherData. We hire against them and evaluate against them:

Nice-to-haves

Detection-as-code practice
Cloud and identity telemetry depth
Experience building labeled datasets or evaluations
Familiarity with LLM-based systems and their failure modes
Purple team, adversary emulation, or offensive security background
Position: Security Engineer / Senior Security Engineer, Detection & Response (leveled to experience)
Employment type: Full-time
Location: Bellevue, WA
CipherData · careers@cipherdata.ai
Ready to apply?
Ready to apply?
Applications are handled through our external careers portal. Click below to submit your application for this role — we read every one and reply within a week.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aigopythonllm

Platform: careers-html
Effort: medium