Cyber Security Specialist (AI Defenses)

• Accelerate detection and triage: Implement AI-assisted alert enrichment (context correlation, reputation checks, summarization) and tune detections to reduce noise and improve prioritization
• Expand AI threat coverage: Build and maintain detections, correlations, and playbooks for AI-enabled threats (deepfakes, synthetic phishing/impersonation, prompt injection, risky plugins/connectors, and anomalous AI tool usage), with routine testing and tuning.
• Operationalize AI monitoring and response: Establish monitoring for AI tools (identity, device, data, network, audit/DLP signals) and publish AI incident response runbooks with escalation criteria, evidence standards, and tabletop validation.

Measures of Success (First 6-12 Months)

• Detection catalog in production: Publish an AI threat detection catalog mapped to telemetry sources and deploy an initial prioritized detection set with a monthly tuning cadence.
• Faster, cleaner triage: Reduce repeat false positives and improve time-to-triage/time-to-escalation for AI-related alerts through enrichment and tuning.
• Monitored guardrails: Stand up baseline monitoring and anomaly thresholds for approved AI tools and deliver recurring executive-ready reporting on risky usage patterns and remediation.
• Validated response capability: Publish AI-focused IR runbooks and validate via tabletop exercises; feed lessons learned into playbooks and detection tuning.

• Security operations/detection engineering/IR experience with SIEM/SOAR workflows; automation/scripting skills (e.g., Python, KQL/SPL).
• Working knowledge of AI/ML risk patterns (prompt injection, data leakage, and over-trust of outputs).