安全检测工程师（AI安全运营方向）-安全与风控
Core
Design and maintain detection rules and logic across terminal, identity, network, cloud, email, SaaS, and data access scenarios to transform attack hypotheses into actionable detection packages.
Role type
Senior Security Operations Engineer (AI Security & Detection Engineering)
Builds
Detection packages, cross-domain correlation capabilities, and AI security monitoring workflows for SOC platforms.
Domain
Cybersecurity, Threat Detection, AI Security Operations
Deliverable
production ML models
Required skills
Detection rule design, SIEM/EDR/NTA/NDR data analysis, Attack chain mapping (ATT&CK), Data governance, Detection lifecycle management, AI security concepts (Prompt injection, RAG, Agent abuse)
Preferred skills
Detection-as-Code, ClickHouse/Kafka/Elastic/Splunk, Python scripting, SOAR workflows, LLM/RAG/Agent security
Technologies
SIEM, EDR, NTA, NDR, Cloud Security, IAM, WAF, KQL, SPL, SQL, Sigma, YARA, EQL, Lucene, Python, ClickHouse, Kafka, Elastic, Splunk, Sentinel, Chronicle, Snowflake, OpenCTI, MISP, TheHive, DFIR-IRIS, SOAR
Responsibilities
Design detection rules and logic for multi-domain security scenarios; Build cross-domain correlation and attack path detection capabilities; Manage data governance, alert deduplication, and enrichment processes; Establish detection quality mechanisms including testing, replay, and CI/CD pipelines; Collaborate on AI security detection scenarios and optimize AI pre-judgment workflows.
Seniority
Senior, hands-on IC