Forward Deployed Engineer - AI SOC
AHEAD
$160,000–$200,000
Jul 13, 2026
—
Jul 21, 2026
What this job asks for AI summary
A hands-on engineering role focused on deploying and integrating security and AI capabilities — including SIEM, XDR, SOAR, and AI-assisted SOC workflows — directly into customer and enterprise environments. The work spans building data ingestion pipelines, automating investigation and response processes, and operationalizing machine learning use cases within security operations. Suits an experienced engineer comfortable leading technical delivery across cloud platforms while working closely with both customer stakeholders and internal cross-functional teams.
Senior level · 5+ years · Remote · Full-time
Pay in the description: $160,000–$200,000
“or” means any one of them counts — you don't need all of them.
We read this from the posting text with AI. Skim the description below before ruling yourself out.
How this req sits in the market our data
Roughly 2,250 people nationally plausibly meet what this posting asks for (information security analysts). range 1,350–3,400
Applicant volume Moderate — A normal amount of company. The rare requirements below are what will separate a shortlisted application from the rest.
Most people in this occupation already list these. Still required — just not what gets you shortlisted.
What the occupation pays Median $132,021 (middle half $99,961–$167,095). This posting is about at that midpoint.
Estimated from BLS employment for this occupation and area, per-skill prevalence across our listing corpus, and published wage benchmarks — as of Jul 28, 2026. It is a model, not a headcount.
Why we read it this way (8)
The SOC classification is a genuine judgment call: the role is titled 'Forward Deployed Engineer' and blends hands-on security operations (SIEM/XDR/SOAR deployment, SOC workflow operationalization) with software/platform engineering (pipeline building, API integrations, automation). 15-1212 Information Security Analysts was chosen as primary because the core delivery context is security operations and SOC enablement; 15-1252 Software Developers is a strong runner-up given the engineering depth required.
The compensation figure ($160,000–$200,000/year) is described as On-Target Earnings (OTE), which includes base salary plus any applicable target bonus — not a pure base salary range.
The degree requirement states 'Bachelor's degree … or equivalent practical experience,' so no formal degree is hard-gated.
LLMs and AI/ML concepts (anomaly detection, behavior analytics, vector search) appear in the 'Technical Skills' section with the qualifier 'Working knowledge of,' which is softer than 'strong/deep/proven experience.' However, the section is part of the required qualifications block, so it is treated as a hard gate on the capability. The specific named tools (LLMs, vector search) are captured; the broader concepts are omitted as non-tool items.
Kafka and the listed data/analytics platforms (Kinesis, Pub/Sub, Spark, Databricks, BigQuery, Snowflake) are explicitly called 'a plus' in the required qualifications section, so they are marked preferred. Kafka is used as the primary name with the others as alternatives.
CI/CD and infrastructure-as-code (Terraform) appear only under Preferred Qualifications.
Webhooks and event-driven workflow patterns are subsumed under the REST/API integration skill rather than emitted as separate skills, as they describe integration patterns rather than distinct named technologies.
Caller marked this a fully-remote role — scored against the national candidate pool.
Read the full posting
The employer publishes the full description on their own site — read it there ↗. Or sign in to read it here — it's free, and it also lets you track this application.