Job description

ABOUT 7AI 7AI is the foundational AI security company. Founded in 2024 by Cybereason co-founders Lior Div and Yonatan Striem-Amit, we came out of stealth in February 2025 to take on the non-human work of the SOC. Our platform pairs a federated SIEM with AI agents that detect, investigate, respond, and hunt, plus dedicated threat hunting and threat intelligence, with humans on the loop. Backed by $166 million in total funding from investors including Index Ventures and Blackstone, we're building the AI foundation for security operations in the agentic era, and we're still early. That's the appeal: you'll join at a pivotal stage where your work shapes what 7AI becomes, alongside security veterans who've built this before. Our culture runs on respect, collaboration, and a shared bar for excellence, all pointed at one goal, delivering real outcomes for the customers who trust us to defend them. OVERVIEW 7AI's AI agents take on a lot of the SOC's non-human work, but scaling that trust requires senior analysts who can validate the hardest cases and mentor the team doing it. As a Tier 3 Security Analyst, you'll be the technical lead and escalation point for junior analysts reviewing 7AI's AI agent investigations. You'll validate the agents' work, prove out the threats they stopped, and help customers understand the risk that was prevented. You'll also hunt for malicious activity in customer environments using 7AI's agents, and help build the processes that let this team scale without losing quality. WHAT YOU'LL DO - Review and validate the AI agents' investigations for accuracy and completeness, assessing risk - Serve as the technical escalation point for junior analysts and mentor them - Correlate data across cloud, endpoint, identity, and network sources to build the full picture of an attack - Investigate malicious activity the AI agents responded to, and assess the risk that was prevented for customers - Use 7AI's AI agents to hunt for emerging threats in customer environments, feeding new detections back into the product - Support customers with ongoing threat monitoring, triage, and alert prioritization, especially during active incidents - Proactively review logs and findings to catch potential threats and anomalies early - Communicate clearly with customers across technical levels, from SOC analysts to CISOs - Help design processes that let the team scale while keeping quality consistent - Work with Sales, Engineering, and Product to share customer feedback and help tune the platform - Stay current on emerging attack techniques and trends, including AI-driven attacks WHAT WE'RE LOOKING FOR - 5+ years of experience in security operations - Hands-on experience investigating alerts across endpoint, network, identity, email, and cloud sources - Strong understanding of security monitoring tools such as XDR, SIEM, IDS/IPS, and IDP - Familiarity with log and telemetry concepts - Strong knowledge of common attack techniques and frameworks such as MITRE ATT&CK, and incident triage methodologies - Strong analytical and problem-solving skills, with the ability to verify AI-driven analysis and make independent security decisions - Data querying experience with SIEM query languages such as SPL, KQL, FQL, or SQL - Strong knowledge of malware analysis methods - Strong interpersonal skills and a service-oriented mindset - A track record of collaborating well on a team, including mentoring others and teaching complex concepts NICE TO HAVE - Experience in a managed services environment - Incident handling experience - Relevant certifications such as Security+, GSEC, or GCIH

Requirements

Must-haves

Review and validate the AI agents' investigations for accuracy and completeness, assessing risk
Serve as the technical escalation point for junior analysts and mentor them
Correlate data across cloud, endpoint, identity, and network sources to build the full picture of an attack
Investigate malicious activity the AI agents responded to, and assess the risk that was prevented for customers
Use 7AI's AI agents to hunt for emerging threats in customer environments, feeding new detections back into the product
Support customers with ongoing threat monitoring, triage, and alert prioritization, especially during active incidents
Proactively review logs and findings to catch potential threats and anomalies early
Communicate clearly with customers across technical levels, from SOC analysts to CISOs
Help design processes that let the team scale while keeping quality consistent
Work with Sales, Engineering, and Product to share customer feedback and help tune the platform
Stay current on emerging attack techniques and trends, including AI-driven attacks
5+ years of experience in security operations
Hands-on experience investigating alerts across endpoint, network, identity, email, and cloud sources
Strong understanding of security monitoring tools such as XDR, SIEM, IDS/IPS, and IDP
Familiarity with log and telemetry concepts
Strong knowledge of common attack techniques and frameworks such as MITRE ATT&CK, and incident triage methodologies
Strong analytical and problem-solving skills, with the ability to verify AI-driven analysis and make independent security decisions
Data querying experience with SIEM query languages such as SPL, KQL, FQL, or SQL
Strong knowledge of malware analysis methods
Strong interpersonal skills and a service-oriented mindset
A track record of collaborating well on a team, including mentoring others and teaching complex concepts

Nice-to-haves

Experience in a managed services environment
Incident handling experience
Relevant certifications such as Security+, GSEC, or GCIH

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aisql

Platform: ashby
Effort: quick