Full job description

Here at Appian, our values of Intensity and Excellence define who we are. We set high standards and live up to them, ensuring that everything we do is done with care and quality. We approach every challenge with ambition and commitment, holding ourselves and each other accountable to achieve the best results. When you join Appian, you’ll be part of a passionate team dedicated to accomplishing hard things, together.

Lead AI Security Engineer (Agentic SOC)

Location: McLean/Tysons, VA | On-site (5 days/week)

ABOUT THE TEAM

We are pioneering the next generation of cyber defense by building an Agentic Security Operations Center (SOC). Our mission is to move beyond reactive alerting by creating self-orchestrating, context-aware AI systems capable of autonomous triage, semantic correlation, and proactive threat mitigation. In this role, you will leverage emerging AI capabilities to reimagine how we defend our organization.

THE OPPORTUNITY

The AI SOC Engineering team is at the center of bringing our vision for AI-driven security to This is a squad of builders operating at the intersection of Generative AI, software engineering, and offensive/defensive security. We don't just write scripts; we architect the intelligent fabric of our defensive posture. We build and deploy production-grade, proprietary multi-agent systems that empower our human analysts to handle complex incident response with autonomous agents AI in responsible and scalable ways.

WHAT YOU'LL DO

Build & Deploy Agents: Design, test, and deploy autonomous and semi-autonomous AI agents that integrate natively with our enterprise security stack (SIEM, EDR, XDR, and Threat Intel feeds).
Code the Playbooks: Translate traditional, human-centric SOC playbooks and analyst workflows into deterministic and heuristic agentic pipelines (using DAGs and multi-agent routing).
Optimize RAG Pipelines: Design, optimize, and maintain production-grade Retrieval-Augmented Generation (RAG) workflows to inject real-time security context, network topology, and historical incident logs into agent prompts.
LLM Performance Engineering: Continuously evaluate, benchmark, and optimize LLM performance, context window utilization, latency, and cost-efficiency across various models (OSS and commercial).
Design Human-in-the-Loop (HITL): Collaborate deeply with Tier 3 Analysts and Threat Hunters to engineer seamless HITL handoff mechanisms, ensuring agents safely escalate complex anomalies to humans.