Security AI Engineer

About StrangeBee

StrangeBee is a European cybersecurity software company specializing in Incident Response. Founded in 2018 by the creators of TheHive and Cortex, StrangeBee evolved open-source initiatives into enterprise-grade solutions trusted by organizations worldwide. TheHive is a leading incident response platform empowering security analysts to detect, investigate, and respond to cyber threats efficiently. StrangeBee is now a commercial software vendor focused on delivering robust, scalable, and continuously evolving solutions for modern security teams. Our ambition is to strengthen our product ecosystem, meet the fast-growing demands of the cybersecurity market, and establish StrangeBee as a global leader in incident response platforms. We are growing fast and looking for people who want to grow with us.

Job Description

Join StrangeBee to shape the future of AI applied to incident response. As a Security AI Engineer, you will operate at the intersection of operational cybersecurity and artificial intelligence: Design AI agents that assist SOC analysts, ensure their reliability and robustness, and contribute to the AI product vision within TheHive. You will leverage your understanding of analyst workflows to build solutions addressing real operational needs.

Responsibilities

AI Agent Design & Development

• Develop and maintain AI agents used to automate incident triage, observable enrichment, and report generation.
• Design automated investigation workflows based on SOC processes.
• Contribute to integrations connecting LLMs with TheHive and Cortex.

Evaluation & Quality

• Own the AI agent testing framework, including evaluation scenarios, assertions, and performance measurement.
• Build realistic datasets and testing environments.
• Improve reliability, including success rate, response quality, and regression detection.

AI Agent Security

• Protect agents against prompt injection, data leakage, and behavioral manipulation.
• Design adversarial tests to assess robustness.

AI Product Vision

• Identify high-value use cases.
• Propose new features.
• Challenge technical and product decisions.
• Represent field needs based on SOC workflows.

Success Criteria (6–12 months)

• Agents are used in production and cover key use cases.
• Evaluation framework provides reliable metrics.
• Attack vectors are identified and documented.
• Active contribution to AI product decisions.

Requirements

Must-have

• Operational cybersecurity experience (SOC, incident response, threat analysis).
• Strong Python skills (production-level code).
• Understanding of LLMs and prompt engineering.

Nice-to-have

• Experience with TheHive, Cortex, or SOAR platforms.
• Basic Go knowledge.
• Docker / CI/CD.
• MCP (Model Context Protocol).
• AI security awareness.
• Model evaluation tools (e.g., promptfoo).

Soft Skills

• Curiosity and continuous learning.
• Autonomy.
• Clear communication.
• Product mindset.

Why join us

At StrangeBee, you’ll help shape a growing European cybersecurity leader. What makes us different is not only what we build, but how we build it.

• **Customer Centric:** Everything we do starts with impact. We build for real security teams facing real threats. We listen carefully, challenge assumptions, and aim to deeply understand the “why” behind every need. If you care about delivering meaningful value — not just shipping features — you’ll feel at home here.
• **Quest for Excellence:** “Good enough” is not our standard. We continuously question how we work, how we collaborate, and how we improve our product. Excellence for us means rigor, accountability, and pride in craftsmanship — whether in code, sales conversations, customer support, or internal processes.
• **Embrace Change:** Cybersecurity evolves constantly — so do we. We encourage initiative, ideas, and constructive challenge. If you see something that could be better, you’re expected to speak up and help drive improvement. Change is not something we endure; it’s something we actively shape.
• **One Team:** We believe performance comes from trust. We foster open communication, mutual respect, and psychological safety. Everyone’s voice matters, and collaboration goes beyond titles or departments. We succeed together.

Joining StrangeBee means working in an environment where ownership is real, standards are high, and impact is visible — while being part of a team that genuinely supports each other.

Hiring process

We aim to keep our process transparent, structured, and respectful of your time.

• HR discovery call (~30 min)
• Cybersecurity & analyst interview (~1h)
• Development & AI interview (~1h)
• Manager interview (~1h)
• Final HR discussion (~30 min)

Please note we may conduct a reference check before finalizing the offer.

Key skills/competency

• AI Agent Design & Development
• Incident Response
• SOC Analyst Workflow
• LLM Integration
• Prompt Engineering
• AI Security
• Threat Analysis
• Python Development
• Product Vision
• Cybersecurity Software