Lead AI Security Automation Engineer

What matters most

• Lead while remaining hands-on

  The role builds and mentors an AI Automation Engineering team while leading architecture, code reviews, cross-team decisions, and hands-on delivery.

• Deliver agentic security workflows

  Design production-grade agents with memory patterns, guardrails, and tool-use orchestration; build retrieval and context approaches using semantic search, grounding, summarization, and prompt/version management.

• Make AI behavior measurable and safe

  Establish evaluation, regression testing, and observability frameworks, alongside standards for reliability, security, and safe operation. The posting also emphasizes privacy, governance, and risk management.

• Build scalable, governed integrations

  Engineer cloud-native, distributed AI services and secure APIs that connect to security platforms. Optimize latency, throughput, caching, context efficiency, and cost.

• Serve cybersecurity operations

  The platforms are intended to support security teams’ detection, threat hunting, incident response, and SOC work. The role partners with cyber security, infrastructure, and continuity teams and includes occasional Level 3 incident escalation.

Likely challenges to think through

• Autonomy versus control

  Preparation hypothesis: Giving agents useful tool access may conflict with the need for safe, governed security operations. Prepare to explain how you would scope permissions, apply guardrails, validate actions, and evaluate agent behavior without assuming a specific State Street implementation.

• Retrieval quality versus speed and cost

  Preparation hypothesis: Better grounding and richer context may increase latency and expense in security workflows. Prepare a design rationale for retrieval, summarization, caching, and prompt versions, including how you would measure quality alongside performance.

• Frequent releases versus production reliability

  Preparation hypothesis: Iterating on AI behavior while maintaining dependable security services may be difficult. Prepare to describe regression tests, observability, peer review, secure coding, and CI/CD controls that would support releases without treating model outputs as inherently reliable.

• Technical depth versus leadership breadth

  Preparation hypothesis: Remaining hands-on while mentoring a distributed team, aligning partner groups, and handling occasional escalations will require prioritization. Prepare an example of how you would delegate design and operational ownership while retaining clear technical decision-making and escalation paths.

Topics to prepare

• Agentic AI architecture

  Revise agents, memory patterns, guardrails and tool-use orchestration. Practice explaining how a security-workflow agent should handle a failed tool call or an unsafe action; the posting calls for reliable, production-grade agentic platforms.

• Retrieval and context engineering

  Revise embeddings, semantic search, grounding, summarization and prompt/version management. Practice comparing two context-selection approaches for a hypothetical threat-hunting query; the role explicitly architects enterprise RAG systems.

• Distributed cloud-service trade-offs

  Revise asynchronous processing, durable messaging, containers, serverless patterns and distributed data access. Practice tracing a failed event through a proposed service and discussing latency, throughput, caching and cost; these are stated platform concerns.

• AI quality and operational safety

  Revise evaluation, regression testing, observability and responsible AI principles, including privacy and governance. Practice defining quality and safety checks for a hypothetical agent release; the role establishes evaluation frameworks and engineering standards.

• Cybersecurity operations context

  Revise how threat detection, threat hunting, incident response, threat intelligence and SOC operations differ. Practice mapping where an AI-generated finding would need analyst review in a hypothetical incident; the platforms are intended to support these functions.

• Technical leadership decisions

  Revise how to justify architecture choices, set review standards and mentor engineers across teams. Practice presenting a trade-off between two agent designs and the review criteria you would apply; the role leads architecture, code reviews and a distributed team.

Skills to revise

• Prototype a guarded agent workflow

  Practice implementing a small agent with tool-use orchestration, a memory pattern and a guardrail using one listed framework, such as LangGraph. Use a synthetic security task; hands-on agent delivery is central to the posting.

• Implement a grounded retrieval flow

  Practice building a small RAG flow with embeddings and semantic search over synthetic security notes, then inspect whether answers are grounded and compare prompt versions. The posting explicitly seeks hands-on RAG and context-engineering expertise.

• Build and review a secure integration

  Practice writing a Python service endpoint that accepts a synthetic security event, invokes an AI workflow and handles invalid input and failures; review its security and reusability. The role builds governed APIs connecting AI capabilities to security platforms.

• Test an event-driven service

  Practice connecting a containerized service to event-driven messaging, then test duplicate events, failures and throughput using synthetic data. Containers, durable messaging, reliability and performance optimization are explicit requirements.

• Create evaluation and release checks

  Practice writing regression cases for grounded answers, unsafe tool requests and latency, and adding automated checks to a sample Jenkins or Argo CD pipeline. The posting calls for AI evaluation, observability and reliable CI/CD releases.

• Conduct a code-review and mentoring exercise

  Practice reviewing a sample AI-assisted code change for correctness, tests and secure coding, then write concise feedback and an architecture decision. The role mentors engineers and requires validation of enterprise-authorized AI coding-tool outputs through peer review and automated testing.

• Prepare a production AI project walkthrough

  The role calls for production-grade LLM and agentic systems. If available, bring an anonymized example showing your architecture decisions, hands-on contribution, deployment, measurable results and lessons learned; otherwise label the walkthrough hypothetical.

• Sketch a security-agent design

  As a practice exercise, diagram an agent assisting a threat-hunting or incident-response workflow. Show tool permissions, memory, guardrails, human approval points, failure handling and secure API integrations; do not present it as a State Street system.

• Explain a retrieval and context strategy

  Prepare a short design for embeddings, semantic search, grounding, summarization and prompt versioning. Include how you would protect sensitive security data and check whether retrieved evidence supports an answer.

• Draft an evaluation and safe-operation plan

  The posting calls for regression testing, observability and responsible AI. Prepare example tests and metrics for answer quality, agent behavior, privacy, reliability and performance, plus a response to unsafe or incorrect outputs.

• Show evidence of platform engineering

  Gather concise examples, where available, of secure APIs, event-driven or distributed services, cloud deployment and CI/CD. Be ready to explain tradeoffs involving latency, throughput, caching, cost and deployment reliability.

• Prepare a technical-leadership example

  Outline a real example, if available, of mentoring engineers, resolving an architecture decision or leading cross-team delivery. Identify the decision, stakeholders, your hands-on role and outcome; distinguish your work from the team's.

• Write targeted questions for the employer

  Ask how CyberDNA prioritizes security workflows, evaluates agents, governs access to security data and coordinates with Global Cyber Security and infrastructure teams. Clarify expectations for the 2–4 in-office days and occasional Level 3 escalations.