Why this role
AI has shrunk the time between a vulnerability's disclosure and its exploitation to days, sometimes less. Patching can't keep that pace, so exposures have to be closed before the patch ships, and attacks in progress have to be caught.
You'll own that defensive side at Defendermate: the compensating controls we deliver as code, the detections that watch for attacks in play, and the proof that both actually work. Then you'll build the agents that do it for every team that uses us.
What you'll build
- Mitigation as code: bounded, deployable compensating controls (Terraform, Kubernetes network policy, security groups, WAF rules) that remove a specific, proven exposure.
- Detections: rules for the techniques along each attack path, with measured coverage and gaps.
- The agents: AI agents that propose and validate those controls and detections in a customer's environment.
- The proof: evidence that each control closes, and each detection catches, exactly what it claims.
What you'll do
- Turn verified exposures and attack paths into controls that state exactly which harm they remove.
- Write and validate detections (Sigma and platform rule languages).
- Review fixes and their rollout for safety and completeness.
- Build realistic test scenarios in our cloud lab.
- Write agents for your domain and set the bar they're tested against.
Your first year
- First 90 days: test sets for mitigation and detection exist, and the first results show which controls hold.
- First year: mitigations for our launch use cases are validated, detection coverage is measured per technique, and the agents in your domain pass their tests.
You might be a fit if
- You've built environments and controls with Terraform or Ansible that reproduce reliably.
- You turn attacker behaviour into detections that work (Sigma, SIEM or EDR rule languages).
- You know AWS security in practice: security groups, NACLs, WAF, IAM, Kubernetes network policy.
- You understand how attacks chain, so your controls target the right step.
- You write strong, tested Python and use AI tools heavily.
Bonus points: detection engineering at an MDR, MSSP, SOC or security vendor; attack simulation or purple teaming; MITRE ATT&CK and D3FEND; agent tooling; Kubernetes security.