AI security engineer (agentic SOC)

Agents now read alerts, call tools and close cases inside the SOC. The AI security engineer owns the boundary around that autonomy: which tools the agent may reach, under whose identity, with what spend and blast-radius ceiling, and which actions still stop at a human. The craft is treating every part of the pipeline — alert bodies, tool descriptions, registry entries, memory, model output — as untrusted input, and leaving lineage behind so an incident involving the agent can actually be reconstructed. The role is judged on two things: whether the agent stayed useful, and whether an attacker could steer it without anyone noticing.

• ·Review and approve tool manifests before they enter the agent's catalog, and re-review them on every version bump.
• ·Set and defend approval ceilings, spend limits and blast-radius scopes for autonomous actions.
• ·Treat alert bodies, ticket text and memory notes as untrusted content that must never become instruction.
• ·Enforce per-tool identity and token audience so one credential cannot open every door.
• ·Verify tenant isolation on anything the agent reads or writes on a customer's behalf.
• ·Keep provenance: which tool, which model, which server produced each claim in a case.
• ·Hunt shadow servers and registry drift — entries whose build no longer matches what was approved.
• ·Run adversarial suites against the gateway and the tools you ship, and publish what survived.

1. 08:30Overnight autonomy review
   Read what the agent did unattended: which actions it took, which it held for approval, and whether any approval was granted on a prompt the agent itself wrote.
2. 09:30Catalog intake
   A team wants a new tool in the agent's catalog. Read the description as an attacker would, tighten the schema, scope the credential and decide whether it can ever run without a human.
3. 11:00An injected alert
   An alert body contains instructions. Trace what the agent did with it, confirm the policy held, and fix the place it nearly did not.
4. 13:30Identity and tenancy
   Audit token audiences across the gateway. One shared credential across three agents is the finding that outranks everything else on the board.
5. 15:00Adversarial run
   Replay the suite against the current policy, record which cases the gateway survived, and file the ones it did not with an owner and a date.
6. 16:30Provenance and handover
   Close the day by checking lineage on the cases the agent touched — a claim without a source is a case that cannot be defended.

• Untrusted-content discipline

  Recognize instruction smuggled into alert bodies, tickets, tool descriptions and memory, and keep it out of the agent's control plane.

  a-210ag-alert-injectionag-memory-contaminationag-tool-poisoning
• Tool supply-chain review

  Audit a manifest, rewrite a poisoned one, and detect registry or binary drift behind an approved entry.

  a-220mcp-f1-safe-toolmcp-f2-harden-poisonedag-registry-integrity
• Agent identity and tenancy

  Scope tokens by audience, stop confused-deputy calls and prove one tenant's data never reaches another.

  ag-token-audienceag-confused-deputyag-cross-tenant-state
• Oversight and blast radius

  Set approval ceilings and spend limits an agent cannot argue its way past, and contain one that has already been steered.

  ag-blast-radiusag-cost-exhaustionag-elicitation-abuse
• Provenance and after-action

  Reconstruct which tool and which model produced a claim, and defend the record in a debrief.

  ag-lineage-gapag-shadow-discoverya-230ag-shift-capstone

• MCP gateways and tool registries
• SIEM and SOAR platforms with agent-assisted triage
• Identity providers, token introspection and audience scoping
• Policy engines and approval workflows
• Adversarial test suites and evaluation harnesses

What separates a good analyst

• Can explain, without slides, why a tool description is part of the attack surface.
• Reaches for identity and audience before reaching for a model-side filter.
• Writes policy as a ceiling on actions, not as a prompt asking the agent to behave.
• Keeps the agent useful — a posture that denies everything is a failure, not a win.
• Has run an adversarial suite against their own tool and published what broke.

• Senior AI security engineer
• Agent platform security lead
• Detection and response architect
• Head of AI assurance