SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
TENEX.AI is an AI-native, automation-first Managed Detection and Response (MDR) provider backed by leading investors including Andreessen Horowitz, Crosspoint Capital Partners, Shield Capital, and others. The company is rapidly growing and seeking a Forward Deployed Security Automation Engineer to own the integration layer between AI agents and security platforms.
Reporting to Software Engineering, you will be responsible for deploying and maintaining SIEM, SOAR, and EDR environments across multiple vendors (CrowdStrike, SentinelOne, Microsoft Defender, Splunk, Microsoft Sentinel, Google SecOps). Key responsibilities include:
- Operating and configuring security platforms: Deploy, configure, and maintain sandboxes across vendors. Manage prevention policies, host groups, custom IOAs, exclusions on EDR platforms, detection content on SIEM platforms, and connectors on SOAR platforms.
- Resolving platform issues: Troubleshoot and resolve EDR agent problems, manage performance impacts, kernel/driver conflicts, upgrade rollouts, and false positive tuning.
- Building production software: Develop, test, and deploy production Python services (not scripts). Manage full lifecycle including APIs, workers, queues, tests, CI, and containers.
- Automating detection and response: Partner with engineering teams to build automated containment and remediation workflows including host isolation, process kills, file quarantine, account disabling, and ticket creation.
- Designing safety guardrails: Architect strict guardrails on automated response actions—approval thresholds, allow lists for critical hosts, rate limits on isolation actions, audit trails, and safe release/rollback paths.
- Owning platform reliability: Take end-to-end ownership of platform reliability and latency outcomes (time from alert to containment). Participate in on-call rotation for security tooling.
- Building internal tooling: Create and maintain tools for other teams with proper observability, logging, metrics, and alerting.
Location: San Jose, CA or Overland Park, KS with 4 days onsite M-TH required.
REQUIREMENTS:
- Deep, hands-on experience operating multiple SIEM/SOAR/EDR platforms
- Proven software engineering experience building and maintaining production Python services and APIs
- Experience integrating with complex vendor APIs and managing auth, rate limits, and retries
- Demonstrated experience building automated detection and response workflows with carefully designed safety guardrails
- Track record of taking end-to-end production ownership of a platform, not just a component
- Bachelor's or Master's degree in Computer Science, Engineering, or related field
NICE-TO-HAVES:
- Experience managing multi-tenant EDR structures
- Proficiency in Go and/or Python
- Detection-as-code experience (rules in version control, testing, CI deployment)
- Background at MDR/MSSP providers, SOAR vendors, EDR vendor engineering teams, or detection/response teams at security-mature tech companies
- Relevant certifications (AWS/GCP Professional Engineer, Kubernetes, or security-related credentials)
