Forward Deployed Engineer- Cyber Security Agents

About the role
RiyaLabs is looking for a Forward Deployed Engineer (FDE) to build and deploy AI agents that help enterprise security teams investigate threats, automate repetitive workflows, and strengthen their security operations.
This is a hands-on, customer-facing engineering role at the intersection of cybersecurity, AI, and software development. You will work directly with customers to understand their security environment, integrate with existing tools, and take solutions from discovery and proof of concept to reliable production deployment.
We’re looking for someone who can build beyond a chatbot—connecting agents to real security data, grounding recommendations in evidence, and implementing safeguards around every action.
What you’ll do
Work with security leaders, SOC analysts, and engineering teams to identify high-value workflows and define measurable success criteria.
Build agents for alert triage, investigation, threat-intelligence enrichment, incident summarization, and response recommendations.
Develop workflows for vulnerability prioritization, endpoint-security monitoring, identity investigations, and compliance-evidence collection.
Integrate agents with SIEM, SOAR, EDR/XDR, cloud-security, identity, ticketing, and knowledge-management platforms.
Normalize security telemetry and correlate signals across logs, alerts, assets, identities, and threat intelligence.
Implement retrieval, structured outputs, tool calling, and workflow orchestration to produce actionable, evidence-backed results.
Design approval gates, least-privilege access, audit trails, and escalation paths. Require explicit authorization for disruptive actions such as isolating endpoints, disabling accounts, or blocking traffic.
Build evaluations that test investigation quality, unsupported conclusions, missed signals, tool-use accuracy, and resistance to prompt injection.
Own deployment, observability, troubleshooting, documentation, and customer handover.
Convert lessons from deployments into reusable connectors, playbooks, and product improvements.
Example projects
Depending on customer priorities, you could work on:
SOC investigation agents that enrich alerts, build incident timelines, and prepare analyst-ready case summaries.
Endpoint-security agents that identify coverage gaps, investigate suspicious activity, and recommend approved containment steps.
Database-security agents that analyze unusual access, privileged activity, and potential data-exfiltration signals.
GRC agents that map controls to requirements, organize supporting evidence, and track remediation.
These proposed workstreams align with the SOC, endpoint/database security, and GRC operating model described in your cybersecurity planning material. [2150]
What we’re looking for
Strong software-engineering skills in Python and/or TypeScript, including APIs, authentication, webhooks, testing, and debugging.
Hands-on experience building LLM applications using tool calling, retrieval-augmented generation, structured outputs, and evaluation.
Practical cybersecurity experience in at least one area: security operations, incident response, detection engineering, cloud security, identity security, or vulnerability management.
Ability to work with security logs and write queries in SQL, KQL, SPL, or a comparable query language.
Understanding of authentication, authorization, secrets management, and secure handling of sensitive customer data.
Experience deploying and supporting applications in cloud or customer-controlled environments.
Clear communication skills and the ability to translate ambiguous customer needs into scoped engineering deliverables.
Strong ownership—from the first customer conversation through deployment and ongoing improvement.
You do not need expertise in every security domain or tool. We value strong engineering fundamentals, depth in a relevant area, and the ability to learn quickly.
Nice to have
Experience with platforms such as Microsoft Sentinel/Defender, Splunk, Elastic, CrowdStrike, or comparable security tools.
Familiarity with MITRE ATT&CK, incident-response playbooks, and detection-as-code.
Experience with agent frameworks, MCP integrations, or durable workflow orchestration.
Familiarity with AWS, Azure, or Google Cloud security services.
Experience with Docker, Kubernetes, infrastructure as code, and observability.
Experience supporting regulated enterprises, private-cloud deployments, or strict data-residency requirements.
Previous work in forward-deployed engineering, solutions engineering, or customer-facing implementation.
What success looks like
Agents deliver useful, evidence-backed outputs that analysts can verify.
Customer workflows show measurable improvements in investigation time, consistency, or manual effort.
Integrations operate reliably within agreed security and access boundaries.
High-impact actions follow approved authorization and escalation procedures.
Deployments include clear documentation, monitoring, and a repeatable evaluation process.

Work arrangement
Hybrid