Responsibilities:
Own the architecture of agentic investigation. You help define how signals move from detection into investigation, how investigation state is managed, how tools are designed and exposed to agents, and what a finished investigation contains: the verdict, the timeline, the scope, and the evidence behind every claim. When the team is stuck between options, you make the call, and the foundations you set are what others build on for years.
Build agents that investigate like a strong analyst. You work alongside our SOC and product researchers to learn how experienced analysts actually triage and investigate, then turn that into agent behavior: which questions to ask, which evidence to gather, when to dig deeper, and when to stop and hand off to a human.
Take toil off analysts’ plates. Beyond full investigations, you build LLM-powered pre-processing for the tools and data sources analysts rely on every day. It summarizes, correlates, and highlights what matters, so analysts spend their time on judgment instead of assembly.
Bring a security mindset to the agent itself. The agent reads attacker-influenced data, runs across thousands of customer tenants, and can take action in customer environments. You design as if someone is trying to manipulate it, because someone will. Trust boundaries, tenant isolation, and auditability are part of the architecture from the start.
Treat evaluation as a core part of the product. You define how we measure whether an investigation is correct, well-reasoned, and well-documented, and you make sure no prompt, model, or tool changes without evidence that it helps.
Decide with data what the system does on its own. Based on measured performance, you decide where it acts autonomously, where a person reviews its work, and how that changes over time. You also recognize when a problem doesn’t need an agent at all.
Build for production, not for demos. You design for reliability, latency, and cost at scale. The system keeps working when models are slow, wrong, unavailable, or quietly changed underneath you, and anyone can trace exactly why an investigation reached its conclusion or why an action was taken.
Augment analysts, don’t replace them. You design the handoff between agent and analyst so that when a case reaches a person, the agent’s work makes them faster and better informed. You consider how analysts’ work changes as agents take on more of it, and how we explain agent decisions to partners and customers in a way they can trust.
Prototype your way through hard problems. When the team hits something genuinely uncertain, you dig in first: derisk it, prove out the approach, then hand it off clearly.
Be the engineering face of the Agentic SOC. In conversations with SOC leadership, other engineering teams, product, and executives, you represent the team’s technical perspective clearly and credibly. You drive alignment on key decisions, carry context in both directions, and protect the team from unclear scope.
Balance technical rigor with pragmatism. You push back when a shortcut creates real risk, and you also push back on over-engineering when the goal is discovery. You have a bias for action and frequent feedback from analysts and customers, and you can explain your tradeoffs to engineers and non-engineers alike.
Raise the floor and the ceiling. Your technical leadership is measured by how the whole team performs, not just by what you personally ship. That shows up in thoughtful code review, pairing on problems others are stuck on, and creating leverage through better patterns, tooling, and shared understanding. You partner with the engineering manager on team health, give direct feedback, and model the judgment and accountability you want the team to have.
What You Bring To The Team:
15+ years of experience developing complex software products, including significant time as the technical lead on production systems
Hands-on experience designing, shipping, and operating LLM-based agents in production, covering tool use, context management, structured output, guardrails, and evaluation, along with a clear-eyed understanding of how they fail
A track record of building evaluation for non-deterministic systems, such as labeled datasets, offline evals, and regression gates, and of measuring quality over time rather than at launch
A security mindset: experience building systems that handle untrusted input, enforce multi-tenant isolation, and produce an audit trail that holds up under scrutiny
Experience building systems that make automated decisions with real consequences, and the judgment to know what to automate and what to leave to people
Curiosity about how security analysts think and work, and a willingness to spend real time learning from them
Deep backend expertise in distributed systems, queues, and durable workflows, and concurrency, with a track record of designing for throughput and correctness under load
Strong skills in one or more backend languages and the ability to pick up new ones quickly. Our primary stack is Ruby on Rails, and we expect you to become fluent in it
Experience with AWS, Azure, or other public cloud environments, and with data stores such as Postgres and Redis
Experience with AI coding tools, such as Claude Code
BS or MS in Computer Science or Engineering, or equivalent experience
Bonus Points:
Experience working in or building for a SOC, incident response, threat hunting, or detection engineering. It isn’t required, but it helps a lot, because we build these workflows around how our analysts actually investigate
Familiarity with endpoint and identity telemetry and with attacker tradecraft
Experience attacking or adversarially testing ML or LLM systems
Experience with Ruby on Rails
What We Offer:
100% remote work environment - since our founding in 2015
Generous paid time off policy, including vacation, sick time, and paid holidays
12 weeks of paid parental leave
Highly competitive and comprehensive medical, dental, and vision benefits plans
401(k) with a 5% contribution regardless of employee contribution
Life and Disability insurance plans
Stock options for all full-time employees
One-time $500 reimbursement for building/upgrading home office
Annual allowance for education and professional development assistance
$75 USD/month digital reimbursement
Access to the BetterUp platform for coaching, personal, and professional growth
Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.
We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.
We do discriminate against hackers who try to exploit businesses of all sizes.
Accommodations:
If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response.
Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights.
#BI-Remote