Principal Software Engineer - Agentic SOC

What We Do

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

What You’ll Do

Huntress is building an Agentic SOC. When our detection pipeline raises a signal, an LLM-based agent picks it up and investigates it end-to-end. It gathers telemetry across our products, reconstructs what happened, and makes a well-documented determination about whether the activity is malicious. Over time, it will take on more of the work itself, growing from resolving routine cases to acting fast when it finds an attack and handing analysts cases with the evidence already assembled. We’re hiring a Principal Software Engineer to head this effort.

This system is meant to augment our analysts, not replace them. It takes the high-volume, repetitive work off their plates so they can focus on complex cases and hands-on keyboard intrusions where human expertise matters most. It also reduces toil in the rest of their day by using LLMs to pre-process the output of the tools analysts use constantly, so they start from a clear picture instead of raw telemetry.

This isn’t a chatbot bolted onto a dashboard. The system investigates a large volume of signals a day across thousands of customer organizations. Many signals are benign, but some are live intrusions where minutes matter. The telemetry the system reads comes from environments in which attackers are actively operating. Because the system makes real decisions, like closing an investigation or isolating a host, it has to be right, it has to show its work, and it has to know when to hand off to a person.

As the technical lead, you’ll own the system’s architecture and direction. That means deciding how an investigation is structured, where deterministic code ends and model reasoning begins, what the agent can and can’t touch, how we know it’s working, and which decisions it makes on its own as it proves itself. You’ll work closely with SOC analysts, detection engineers, product, and other engineering teams. You’ll go deep in the code and help the engineers around you grow. Your work will directly shape how Huntress scales protection for the 99%.

We make full use of AI coding tools to enable you to accelerate your development. We don’t cap token usage. We expect you to use AI and all tools responsibly.

Responsibilities

• Own the architecture of agentic investigation. You help define how signals move from detection into investigation, how investigation state is managed, how tools are designed and exposed to agents, and what a finished investigation contains: the verdict, the timeline, the scope, and the evidence behind every claim.
• Build agents that investigate like a strong analyst. You work alongside our SOC and product researchers to learn how experienced analysts actually triage and investigate, then turn that into agent behavior.
• Take toil off analysts’ plates. Beyond full investigations, you build LLM-powered pre-processing for the tools and data sources analysts rely on every day.
• Bring a security mindset to the agent itself. Trust boundaries, tenant isolation, and auditability are part of the architecture from the start.
• Treat evaluation as a core part of the product. Define how we measure whether an investigation is correct, well-reasoned, and well-documented.
• Decide with data what the system does on its own, based on measured performance.
• Build for production, not for demos. Design for reliability, latency, and cost at scale.
• Augment analysts, don’t replace them. Design the handoff between agent and analyst so that investigations make people faster and better informed.
• Prototype your way through hard problems, derisking and proving out approaches.
• Be the engineering face of the Agentic SOC in conversations with leadership and stakeholders.
• Balance technical rigor with pragmatism, maintaining a bias for action.
• Raise the floor and the ceiling through thoughtful code review, pairing, and creating better shared patterns and tooling.

What You Bring To The Team

• 15+ years of experience developing complex software products, including significant time as the technical lead on production systems
• Hands-on experience designing, shipping, and operating LLM-based agents in production
• A track record of building evaluation for non-deterministic systems
• A security mindset with experience building systems handling untrusted input and multi-tenant isolation
• Experience building systems that make automated decisions with real consequences
• Curiosity about how security analysts think and work
• Deep backend expertise in distributed systems, queues, durable workflows, and concurrency
• Strong skills in backend languages; primary stack is Ruby on Rails (expectation to become fluent)
• Experience with public cloud environments (AWS, Azure) and data stores like Postgres and Redis
• Experience with AI coding tools, such as Claude Code
• BS or MS in Computer Science or Engineering, or equivalent experience

Bonus Points

• Experience working in or building for a SOC, incident response, threat hunting, or detection engineering
• Familiarity with endpoint and identity telemetry and attacker tradecraft
• Experience attacking or adversarially testing ML or LLM systems
• Experience with Ruby on Rails