SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 165,000 - 190,000 / annual
Huntress, founded in 2015 by former NSA cyber operators, is building an Agentic SOC—a system where LLM-based agents investigate security signals end-to-end, augmenting human analysts rather than replacing them. The agent gathers telemetry across Huntress products, reconstructs what happened, and makes evidence-backed determinations about malicious activity. It handles high-volume, repetitive work so analysts can focus on complex cases and active intrusions where human expertise is critical.
As a Senior Software Engineer on the Agentic SOC team, you will build and ship core components of this investigation system. You'll work closely with technical leads, SOC analysts, product researchers, and product managers, owning significant pieces end-to-end from ambiguous problems to production features.
Key responsibilities include:
- Design, build, and ship the investigation system components: tools agents use to query telemetry, investigation logic, and structured evidence-backed output for analysts and customers.
- Translate analyst expertise into agent behavior by working with SOC analysts and product researchers to understand triage and investigation workflows, then encode that into agent logic.
- Build LLM-powered features that pre-process tool output, summarizing and highlighting what matters so analysts focus on judgment rather than assembly.
- Measure impact through evaluations that determine whether the system is improving, backing changes with evidence.
- Build with security mindset, considering how the system could be misused or manipulated, especially since it reads attacker-influenced data and operates across thousands of customer tenants.
- Write reliable, observable, cost-conscious production code that behaves well when models are slow, wrong, or unavailable.
- Collaborate through thoughtful code reviews, help teammates, share LLM learnings, and contribute to technical discussions with clear reasoning about tradeoffs.
- Balance rigor with pragmatism, knowing when to prototype quickly versus when the cost of being wrong is high.
Huntress secures more than 5M endpoints and 16M identities worldwide. The company is remote-first and backed by a 24/7 human-led SOC. The role reports to the Director of Engineering.
Requirements:
- 6+ years of professional software development experience, including building and operating production backend systems
- Experience building applications with LLMs, including tool use, structured output, prompt and context design, and evaluation; production agent experience is a strong plus
- Understanding of how LLM-based systems fail and good habits for testing and debugging non-deterministic behavior
- Solid backend fundamentals: APIs, background jobs and queues, concurrency, relational databases (Postgres), data stores (Redis)
- Strong skills in one or more backend languages with ability to pick up new ones quickly; primary stack is Ruby on Rails (prior Rails experience not required)
- Security awareness: understanding of untrusted input, access control, and multi-tenant data isolation
- Curiosity about security analyst workflows and willingness to learn from them
- Experience with AWS, Azure, or other public cloud environments
- Experience with AI coding tools (e.g., Claude Code)
- BS or MS in Computer Science or Engineering, or equivalent experience
Bonus:
- Experience in or building for a SOC, incident response, threat hunting, or detection engineering
- Familiarity with endpoint, identity, and Microsoft 365 telemetry and attacker tradecraft (MITRE ATT&CK)
- Experience building evaluation pipelines or datasets for ML/LLM systems
- Ruby on Rails experience
