[All remote jobs](https://jobicy.com/jobs.md)[![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg)](https://jobicy.com/company/huntress.md)[Huntress](https://jobicy.com/company/huntress.md) # Principal Software Engineer – Agentic SOC Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/huntress.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUndisclosedDepartment[Software Engineering](https://jobicy.com/categories/engineering.md)EmploymentFull TimeExperienceDirectorPublished24 Oct 2026Apply before23 Nov 2026Listing views28Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Huntress is hiring a Principal Software Engineer to lead the architecture and delivery of an Agentic SOC platform that uses LLM-based agents to investigate security detections. The role combines hands-on backend and distributed-systems engineering with technical leadership across SOC analysts, detection engineers, product, and executive stakeholders. The engineer will build secure, auditable agent workflows, establish evaluation and regression practices, and determine appropriate levels of automated action versus human review. Success requires deep production experience with LLM agents, multi-tenant security controls, durable workflows, cloud infrastructure, and high-consequence automation. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a principal-level technical leadership role involving production LLM agents that process attacker-influenced data and can affect customer environments. It requires balancing security, reliability, evaluation rigor, architecture, and cross-functional decision-making under potentially time-sensitive incident conditions. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$227,500US market range (per year)$220k–$275k0$302.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses a base-pay range of $215,000–$240,000 USD, plus bonus and equity. The annual cadence is inferred from the compensation magnitude, US location, full-time status, and senior principal engineering context; the posting does not explicitly say “per year.” Estimated US market compensation for a principal engineer specializing in production AI and security systems is $220,000–$275,000 annually, excluding bonus and equity. ## Core skills Skills and capabilities most closely associated with this opportunity. [LLM agent architecture](https://jobicy.com/jobs?search_keywords=LLM%20agent%20architecture.md)[Cybersecurity engineering](https://jobicy.com/jobs?search_keywords=Cybersecurity%20engineering.md)[Distributed systems](https://jobicy.com/jobs?search_keywords=Distributed%20systems.md)[Durable workflows](https://jobicy.com/jobs?search_keywords=Durable%20workflows.md)[Multi-tenant isolation](https://jobicy.com/jobs?search_keywords=Multi-tenant%20isolation.md)[Security telemetry analysis](https://jobicy.com/jobs?search_keywords=Security%20telemetry%20analysis.md)[LLM evaluation](https://jobicy.com/jobs?search_keywords=LLM%20evaluation.md)[Regression testing](https://jobicy.com/jobs?search_keywords=Regression%20testing.md)[Ruby on Rails](https://jobicy.com/jobs?search_keywords=Ruby%20on%20Rails.md)[AWS](https://jobicy.com/jobs?search_keywords=AWS.md)[PostgreSQL](https://jobicy.com/jobs?search_keywords=PostgreSQL.md)[Redis](https://jobicy.com/jobs?search_keywords=Redis.md)[Incident response workflows](https://jobicy.com/jobs?search_keywords=Incident%20response%20workflows.md)[Technical leadership](https://jobicy.com/jobs?search_keywords=Technical%20leadership.md) Sample interview questionsHow would you design an LLM-based investigation agent that can safely act on attacker-influenced telemetry?I would separate deterministic control logic from model reasoning, enforce strict tool permissions and tenant-scoped authorization, and treat all telemetry as untrusted input. Every tool call and conclusion would be logged with evidence, while high-impact actions would require confidence thresholds, policy checks, and human review until performance is demonstrated. What evaluation approach would you use before allowing an investigation agent to close cases autonomously? I would create labeled historical investigation datasets, define task-specific quality metrics for verdict accuracy, evidence completeness, escalation quality, and false-close risk, then run offline and regression evaluations for every model, prompt, or tool change. I would also use staged production rollout with shadow mode, analyst review, and monitored error budgets before expanding autonomous authority. Describe how you would make an agentic SOC workflow resilient when an LLM provider is slow, unavailable, or changes behavior. I would design explicit timeouts, retries, circuit breakers, model fallbacks, durable workflow state, and safe degradation paths to analyst handoff. Critical decisions should never depend on undocumented model behavior alone; deterministic validation and traceable evidence should remain available regardless of model performance. How would you work with SOC analysts to translate their investigation methods into agent behavior? I would observe and interview experienced analysts, review real investigation artifacts, and identify repeatable decision points, evidence sources, and escalation triggers. I would then implement these as transparent workflow steps, validate outputs with analysts, and use their feedback and labeled cases to continuously improve the agent. How do you balance rapid prototyping with the security and reliability requirements of a production security product? I use prototypes to reduce uncertainty quickly, but isolate experimental components from high-impact production paths. Once an approach is validated, I establish clear interfaces, evaluation gates, observability, failure handling, and ownership before scaling it, ensuring speed does not create uncontrolled operational risk. Opportunity details ## About this role. What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers’ protection. Huntress now secures more than 6M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Director, Engineering Location: Remote US, Only Compensation: $215,000 to $240,000 base plus bonus and equity What You’ll Do: Huntress is building an Agentic SOC. When our detection pipeline raises a signal, an LLM-based agent picks it up and investigates it end-to-end. It gathers telemetry across our products, reconstructs what happened, and makes a well-documented determination about whether the activity is malicious. Over time, it will take on more of the work itself, growing from resolving routine cases to acting fast when it finds an attack and handing analysts cases with the evidence already assembled. We’re hiring a Principal Software Engineer to head this effort. This system is meant to augment our analysts, not replace them. It takes the high-volume, repetitive work off their plates so they can focus on complex cases and hands-on keyboard intrusions where human expertise matters most. It also reduces toil in the rest of their day by using LLMs to pre-process the output of the tools analysts use constantly, so they start from a clear picture instead of raw telemetry. This isn’t a chatbot bolted onto a dashboard. The system investigates a large volume of signals a day across thousands of customer organizations. Many signals are benign, but some are live intrusions where minutes matter. The telemetry the system reads comes from environments in which attackers are actively operating. Because the system makes real decisions, like closing an investigation or isolating a host, it has to be right, it has to show its work, and it has to know when to hand off to a person. As the technical lead, you’ll own the system’s architecture and direction. That means deciding how an investigation is structured, where deterministic code ends and model reasoning begins, what the agent can and can’t touch, how we know it’s working, and which decisions it makes on its own as it proves itself. You’ll work closely with SOC analysts, detection engineers, product, and other engineering teams. You’ll go deep in the code and help the engineers around you grow. Your work will directly shape how Huntress scales [protection for the 99%](https://www.huntress.com/blog/scaling-to-protect-the-99). We make full use of AI coding tools to enable you to accelerate your development. We don’t cap token usage. We expect you to use AI and all tools responsibly. Responsibilities: * Own the architecture of agentic investigation. You help define how signals move from detection into investigation, how investigation state is managed, how tools are designed and exposed to agents, and what a finished investigation contains: the verdict, the timeline, the scope, and the evidence behind every claim. When the team is stuck between options, you make the call, and the foundations you set are what others build on for years. * Build agents that investigate like a strong analyst. You work alongside our SOC and product researchers to learn how experienced analysts actually triage and investigate, then turn that into agent behavior: which questions to ask, which evidence to gather, when to dig deeper, and when to stop and hand off to a human. * Take toil off analysts’ plates. Beyond full investigations, you build LLM-powered pre-processing for the tools and data sources analysts rely on every day. It summarizes, correlates, and highlights what matters, so analysts spend their time on judgment instead of assembly. * Bring a security mindset to the agent itself. The agent reads attacker-influenced data, runs across thousands of customer tenants, and can take action in customer environments. You design as if someone is trying to manipulate it, because someone will. Trust boundaries, tenant isolation, and auditability are part of the architecture from the start. * Treat evaluation as a core part of the product. You define how we measure whether an investigation is correct, well-reasoned, and well-documented, and you make sure no prompt, model, or tool changes without evidence that it helps. * Decide with data what the system does on its own. Based on measured performance, you decide where it acts autonomously, where a person reviews its work, and how that changes over time. You also recognize when a problem doesn’t need an agent at all. * Build for production, not for demos. You design for reliability, latency, and cost at scale. The system keeps working when models are slow, wrong, unavailable, or quietly changed underneath you, and anyone can trace exactly why an investigation reached its conclusion or why an action was taken. * Augment analysts, don’t replace them. You design the handoff between agent and analyst so that when a case reaches a person, the agent’s work makes them faster and better informed. You consider how analysts’ work changes as agents take on more of it, and how we explain agent decisions to partners and customers in a way they can trust. * Prototype your way through hard problems. When the team hits something genuinely uncertain, you dig in first: derisk it, prove out the approach, then hand it off clearly. * Be the engineering face of the Agentic SOC. In conversations with SOC leadership, other engineering teams, product, and executives, you represent the team’s technical perspective clearly and credibly. You drive alignment on key decisions, carry context in both directions, and protect the team from unclear scope. * Balance technical rigor with pragmatism. You push back when a shortcut creates real risk, and you also push back on over-engineering when the goal is discovery. You have a bias for action and frequent feedback from analysts and customers, and you can explain your tradeoffs to engineers and non-engineers alike. * Raise the floor and the ceiling. Your technical leadership is measured by how the whole team performs, not just by what you personally ship. That shows up in thoughtful code review, pairing on problems others are stuck on, and creating leverage through better patterns, tooling, and shared understanding. You partner with the engineering manager on team health, give direct feedback, and model the judgment and accountability you want the team to have. What You Bring To The Team: * 15+ years of experience developing complex software products, including significant time as the technical lead on production systems * Hands-on experience designing, shipping, and operating LLM-based agents in production, covering tool use, context management, structured output, guardrails, and evaluation, along with a clear-eyed understanding of how they fail * A track record of building evaluation for non-deterministic systems, such as labeled datasets, offline evals, and regression gates, and of measuring quality over time rather than at launch * A security mindset: experience building systems that handle untrusted input, enforce multi-tenant isolation, and produce an audit trail that holds up under scrutiny * Experience building systems that make automated decisions with real consequences, and the judgment to know what to automate and what to leave to people * Curiosity about how security analysts think and work, and a willingness to spend real time learning from them * Deep backend expertise in distributed systems, queues, and durable workflows, and concurrency, with a track record of designing for throughput and correctness under load * Strong skills in one or more backend languages and the ability to pick up new ones quickly. Our primary stack is Ruby on Rails, and we expect you to become fluent in it * Experience with AWS, Azure, or other public cloud environments, and with data stores such as Postgres and Redis * Experience with AI coding tools, such as Claude Code * BS or MS in Computer Science or Engineering, or equivalent experience Bonus Points: * Experience working in or building for a SOC, incident response, threat hunting, or detection engineering. It isn’t required, but it helps a lot, because we build these workflows around how our analysts actually investigate * Familiarity with endpoint and identity telemetry and with attacker tradecraft * Experience attacking or adversarially testing ML or LLM systems * Experience with Ruby on Rails What We Offer: * 100% remote work environment – since our founding in 2015 * Generous paid time off policy, including vacation, sick time, and paid holidays * 12 weeks of paid parental leave * Highly competitive and comprehensive medical, dental, and vision benefits plans * 401(k) with a 5% contribution regardless of employee contribution * Life and Disability insurance plans * Stock options for all full-time employees * One-time $500 reimbursement for building/upgrading home office * Annual allowance for education and professional development assistance * $75 USD/month digital reimbursement * Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [accommodations@huntresslabs.com](mailto:accommodations@huntresslabs.com). Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our [Candidate Privacy Notice](https://trust.huntress.com/?itemUid=47f0a941-b86f-4864-a0d0-a224a34cfd57&source=click) for more details on our practices and your data privacy rights. #BI-Remote Show more [Apply now >](https://jobicy.com/jobs/156767-principal-software-engineer-agentic-soc.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Monzo logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/5b4c0ec3-221.jpg) Monzo Oct 24 New ### [Senior Engineering Manager](https://jobicy.com/jobs/156848-senior-engineering-manager-2.md) 🚀 We’re on a mission to make money work for everyone. We’re waving goodbye to the complicated and confusing ways of traditional banking. After starting as a prepaid card, our… * ![Binance logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/bc822f38-221.jpg) Binance Oct 24 New ### [AI Agent Engineer](https://jobicy.com/jobs/156835-ai-agent-engineer.md) Binance is a leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. We are trusted by 300+ million people in 100+ countries for… * ![PolicyMe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/1e29f43a-221.png) PolicyMe Oct 24 New ### [Software Engineer](https://jobicy.com/jobs/156829-software-engineer-13.md) Overview of the role We’re on a mission to modernize insurance, making it simpler, more accessible, and customer-first. The insurance industry is a $1T market that’s remained largely untouched by… * ![Envato logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/01/WRILS-210118161319-940323.jpg) Envato Oct 24 New ### [Cross Reviewer Media](https://jobicy.com/jobs/156814-cross-reviewer-media.md) About Us At Envato, we empower creative pros to thrive. We’re here to help creatives bring their ideas to life, supercharge their workflows, and equip them with an unparalleled toolkit… * ![Synthesia logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/c69aad11-221.webp) Synthesia Oct 24 New ### [Senior Engineering Manager](https://jobicy.com/jobs/156779-senior-engineering-manager.md) Synthesia is the world’s leading AI video platform for business, used by over 90% of the Fortune 100. Founded in 2017, the company is headquartered in London, with offices and… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 24 New ### [Principal Software Engineer, SIEM (Ruby/Rails)](https://jobicy.com/jobs/156769-principal-software-engineer-siem-ruby-rails.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Veriff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4f972095-221.jpg) Veriff Oct 24 New ### [Senior Software Engineer](https://jobicy.com/jobs/156705-senior-software-engineer-16.md) At Veriff’s Biometric Solutions team, we are trying to prove, in real time, that the person on the other side of the screen is real and who they claim to… * ![Monzo logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/5b4c0ec3-221.jpg) Monzo Oct 24 New ### [Senior Backend Engineer](https://jobicy.com/jobs/156699-senior-backend-engineer-12.md) 🚀 We’re on a mission to make money work for everyone. We’re waving goodbye to the complicated and confusing ways of traditional banking. After starting as a prepaid card, our… * ![Welo Global logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/83c40f94-221.webp) Welo Global Oct 24 New ### [Ads Quality Rater – Farsi (Turkey)](https://jobicy.com/jobs/153979-ads-quality-rater-farsi-turkey.md) Welo Data is an award-winning localization and data transformation company. We run one of the world’s largest Ads Rating Programs and we want you to join! As an Ads Quality… * ![Welo Global logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/83c40f94-221.webp) Welo Global Oct 24 New ### [Ads Quality Rater – Cantonese (Hong Kong)](https://jobicy.com/jobs/153976-ads-quality-rater-cantonese-hong-kong.md) Welo Data is an award-winning localization and data transformation company. We run one of the world’s largest Ads Rating Programs and we want you to join! As an Ads Quality… [Browse all jobs](https://jobicy.com/jobs.md)