Senior AI Security Automation Engineer

What matters most

• Deliver production agentic security platforms

  The role leads architecture and hands-on delivery of reliable AI agents for security workflows, including memory, guardrails and tool-use orchestration.

• Ground AI outputs in security data

  The posting calls for retrieval and context engineering using embeddings, semantic search, grounding and prompt/version management, alongside knowledge of cybersecurity telemetry and SIEM data.

• Build governed cloud services and integrations

  Responsibilities include cloud-native services across AWS, Azure and GCP, event-driven and distributed designs, and APIs that connect AI capabilities to security tools and processes while controlling performance and cost.

• Measure and safeguard production behavior

  The engineer establishes evaluation, regression testing and observability frameworks and defines standards for reliability, security and safe AI operation.

• Lead delivery across teams

  The role combines hands-on engineering with mentoring, architecture reviews and collaboration across distributed security and engineering teams; the posting also emphasizes reliable CI/CD and validation of AI-assisted code.

Likely challenges to think through

• Balancing agent autonomy with safe operation

  Preparation hypothesis: tool-using agents may speed security workflows while creating risks from incorrect or excessive actions. Prepare to explain how you would set guardrails, limit tool permissions, test behavior and retain appropriate human oversight.

• Keeping retrieval useful as security data changes

  Preparation hypothesis: large-scale, varied telemetry may make relevant evidence hard to retrieve without adding latency or misleading context. Prepare to discuss data freshness, grounding checks and how you would evaluate retrieval quality for a security workflow.

• Meeting performance targets without uncontrolled cost

  Preparation hypothesis: distributed, multi-cloud AI services may face trade-offs among latency, throughput, context size, caching and cost. Prepare an architecture rationale with measurable performance and cost considerations.

• Balancing platform work with incident support

  Preparation hypothesis: occasional Level 2–3 operational escalations could interrupt planned engineering and cross-team delivery. Prepare to describe how you would diagnose a production issue, communicate across teams and turn findings into reliability improvements.

Topics to prepare

• Agentic AI architecture

  The posting calls for production-grade agents with memory patterns, guardrails and tool-use orchestration. Revision exercise: diagram a security-workflow agent and explain how it handles tool failures, restricted actions and unreliable memory.

• Retrieval and context engineering

  The posting specifies RAG, embeddings, semantic search, grounding, summarization and prompt/version management. Revision exercise: compare retrieval and context-design choices for answering a question from security records; explain how you would detect unsupported answers.

• Cybersecurity data and operations

  The posting names endpoint, network, application, cloud and system telemetry; SIEM analysis; and threat detection, hunting and incident response. Revision exercise: trace how related events become an alert, an investigation and a response decision.

• Responsible and governed AI

  The posting emphasizes privacy, security, governance, resiliency, risk management and safe AI operation. Revision exercise: review a proposed agent-to-security-tool integration and identify data-exposure, authorization and unsafe-action risks, with controls for each.

• Evaluation and observability

  The role establishes evaluation, regression testing and observability frameworks for model quality and agent behavior. Revision exercise: define a small test matrix covering grounded answers, tool-use failures, safety and production performance; explain what changes would trigger regression tests.

• Scalable cloud-native design

  The posting covers AWS, Azure and GCP; containers, serverless and event-driven services; and latency, throughput, caching and cost controls. Revision exercise: sketch an asynchronous AI-service architecture and explain its reliability and performance trade-offs.

Skills to revise

• Implement a guarded agent workflow

  Suggested practice: use Python and one framework named in the posting, such as LangGraph, to prototype an agent that selects a permitted tool, retains limited state and declines an unauthorized action. This rehearses the stated hands-on agent and guardrail work; the prototype is a preparation exercise, not a specified employer project.

• Build and test a small RAG pipeline

  Suggested practice: index a small set of synthetic security notes in a vector database, retrieve relevant passages and produce answers tied to that evidence. Test a missing-evidence case and a prompt revision. This targets the posting’s RAG and prompt-lifecycle requirements.

• Work through telemetry correlation

  Suggested practice: write a Python script that ingests synthetic endpoint and network events, correlates them by time and entity, and produces a concise investigation summary. This reflects the posting’s SIEM, large-scale security-data and threat-analysis focus without assuming access to State Street systems.

• Design a secure integration API

  Suggested practice: specify and implement a small API that accepts a security-workflow request, validates access, invokes a permitted AI capability and records failures. Explain how it would connect to event-driven processing. This addresses the stated secure, governed API and platform-integration work.

• Create an AI regression test set

  Suggested practice: assemble test inputs for grounded retrieval, tool failures and unsafe requests; run them after a prompt or agent change and record quality, latency and failure results. This directly practices the posting’s evaluation, testing and observability responsibilities.

• Review a reliable delivery pipeline

  Suggested practice: outline a CI/CD pipeline for the prototype with automated tests, secure-code checks, review gates and rollback criteria; review any AI-assisted code before inclusion. This reflects the posting’s deployment-reliability requirements and its explicit expectation that enterprise-authorized AI coding outputs be validated.

• Prepare a production AI project walkthrough

  The role calls for hands-on delivery of production LLM systems. If you have a relevant example, prepare a one-page account of your architecture decisions, implementation, deployment, measured results and trade-offs; distinguish your own contributions.

• Sketch a security-agent architecture

  As a practice exercise, draw an agentic security workflow with tool orchestration, memory, guardrails and a governed API. Explain access controls, failure handling and where a human would review consequential actions.

• Work through a telemetry and retrieval example

  Prepare a sample design showing how endpoint, network or cloud telemetry could be ingested and queried alongside grounded RAG. Cover embeddings, semantic search, source attribution and prompt versioning without assuming State Street uses a particular implementation.

• Draft an evaluation and safety plan

  The posting emphasizes regression testing, observability and safe operation. Prepare example test cases and measures for retrieval quality, agent behavior, privacy, reliability and performance, plus how you would investigate a failed result.

• Explain delivery and scaling trade-offs

  Prepare a diagram or brief decision record for a cloud-native service using asynchronous messaging and secure APIs. Be ready to discuss CI/CD checks, deployment reliability, latency, throughput, caching and cost controls.

• Collect leadership and engineering evidence

  If available, select specific examples of mentoring, architecture decisions and collaboration across distributed teams. Prepare code-review or design-decision artifacts you can discuss, including how automated tests and secure coding validated AI-assisted development outputs.

• Write questions for the CyberDNA team

  Ask which security workflows are priorities, how AI evaluations and governance are handled, and how CyberDNA works with Global Cyber Security and infrastructure teams. Clarify expectations for occasional Level 2–3 incident escalations and the stated 2–4 weekly office days.