Cybersecurity Engineer - AI Automation

Job description

Join StrangeBee to shape the future of AI applied to incident response.

As a Cybersecurity Engineer - AI Automation, you will operate at the intersection of operational cybersecurity and artificial intelligence:

• Design AI agents that assist SOC analysts

• Ensure their reliability and robustness

• Contribute to the AI product vision within TheHive

You will leverage your understanding of analyst workflows to build solutions addressing real operational needs.

Responsibilities

AI Agent Design & Development

• Develop and maintain AI agents used to automate:

  • Incident triage

  • Observable enrichment

  • Report generation

• Design automated investigation workflows based on SOC processes

• Contribute to integrations connecting LLMs with TheHive and Cortex

Evaluation & Quality

• Own the AI agent testing framework:

  • Evaluation scenarios

  • Assertions

  • Performance measurement

• Build realistic datasets and testing environments

• Improve reliability (success rate, response quality, regression detection)

AI Agent Security

• Protect agents against:

  • Prompt injection

  • Data leakage

  • Behavioral manipulation

• Design adversarial tests to assess robustness

AI Product Vision

• Identify high-value use cases

• Propose new features

• Challenge technical and product decisions

• Represent field needs based on SOC workflows

Success criteria (6 - 12 months)

• Agents are used in production and cover key use cases

• Evaluation framework provides reliable metrics

• Attack vectors are identified and documented

• Active contribution to AI product decisions

Requirements

Must-have

• At least 5 years of operational cybersecurity experience (SOC, incident response, threat analysis)

• Strong Python skills (production-level code)

• Understanding of LLMs and prompt engineering

Nice-to-have

• Experience with TheHive, Cortex, or SOAR platforms

• Basic Go knowledge

• Docker / CI/CD

• MCP (Model Context Protocol)

• AI security awareness

• Model evaluation tools (e.g., promptfoo)

Soft Skills

• Curiosity and continuous learning

• Autonomy

• Clear communication

• Product mindset

You might feel hesitant to apply if you don’t match 100% of the requirements. This list is a guide, we encourage you to apply even if you are a partial match. We are building teams that innovate, not teams
that simply tick every box.

Hiring process

We aim to keep our process transparent, structured, and respectful of your time.

1. Discovery call with the hiring team (30 minutes)
   A first conversation to understand your background, motivations, and answer your initial questions.

2. Cybersecurity & analyst interview (1h)
   Deep dive into your experience, skills, and the role expectations.

3. Dev & AI interview (1h)
   Deep dive into your experience, skills, and the role expectations.

4. AssessFirst personality assessment
   A short online assessment to help us understand how you work and how you might thrive within the team.

5. Interview with the CTPO (30 minutes)
   Discussion around vision, culture fit, and long-term alignment.

6. Interview with the Head of HR (30 minutes)
   Discussion around vision, culture fit, and long-term alignment.

Please note we may conduct a reference check before finalizing the offer.

About us

StrangeBee is a European cybersecurity software company specializing in Incident Response.

Founded in 2018 by the creators of TheHive and Cortex, StrangeBee was built on the success of these tools that quickly became widely adopted within the cybersecurity community. What started as open-source initiatives evolved into enterprise-grade solutions trusted by organizations worldwide.

Today, TheHive is recognized as a leading incident response platform, empowering thousands of security analysts to detect, investigate, and respond to cyber threats efficiently.

StrangeBee now operates as a fully commercial software vendor, focused on delivering robust, scalable, and continuously evolving solutions tailored to the needs of modern security teams.

Our ambition is clear: strengthen our product ecosystem, meet the fast-growing demands of the cybersecurity market, and establish StrangeBee as a global leader in incident response platforms.

We are growing fast and we’re looking for people who want to grow with us.

Why join us

At StrangeBee, you won’t just join a company, you’ll help shape a growing European cybersecurity leader.

What makes us different is not only what we build, but how we build it.

Customer Centric
Everything we do starts with impact. We build for real security teams facing real threats. We listen carefully, challenge assumptions, and aim to deeply understand the “why” behind every need. If you care about delivering meaningful value, not just shipping features, you’ll feel at home here.

Quest for Excellence
“Good enough” is not our standard. We continuously question how we work, how we collaborate, and how we improve our product. Excellence for us means rigor, accountability, and pride in craftsmanship, whether in code, sales conversations, customer support, or internal processes.

Embrace Change
Cybersecurity evolves constantly, so do we. We encourage initiative, ideas, and constructive challenge. If you see something that could be better, you’re expected to speak up and help drive improvement. Change is not something we endure; it’s something we actively shape.

One Team
We believe performance comes from trust. We foster open communication, mutual respect, and psychological safety. Everyone’s voice matters, and collaboration goes beyond titles or departments. We succeed together.

Joining StrangeBee means working in an environment where ownership is real, standards are high, and impact is visible while being part of a team that genuinely supports each other.