We're building an AI security and guardrail product that protects organizations from the risks of AI agents running on employee endpoints — think coding agents and agentic apps.

You know how EDR/XDR platforms collect and correlate endpoint telemetry, you turn attacker behavior into effective detections, and you want to apply that to agents, prompt injection, tool use, and agent traces. You'll trace the full chain — user prompt → AI agent → tool call → shell → process → file/network → sensitive data — and tell agent behavior apart from legitimate employee activity at every hop.

What You'll Do:

? Design detection rules for endpoint and AI-agent activity, using EDR/XDR telemetry

? Build behavioral detections around event sequences and process relationships — not static indicators

? Identify telemetry gaps blocking detection of new attack techniques; tune for false positives without losing coverage

? Research attacker tradecraft and how legitimate apps/dev tools get abused

? Form and validate detection hypotheses against real telemetry; build attack scenarios to test the product

? Build working knowledge of AI/LLM security — prompt injection, jailbreaking, MCP and agent-to-agent risks

? Analyze agentic traces,



map agent-to-tool-to-shell-to-network interactions, and define guardrails for agents in employee environments.

What you bring:

✅ 3–5 years in cybersecurity — detection engineering, endpoint security, threat hunting, or research

✅ Strong grasp of EDR/XDR, endpoint telemetry, Windows/Linux security

✅ Hands-on writing detection rules, queries, analytics, or behavioral detections

✅ Can design a detection strategy from an attack scenario, not just implement predefined rules

✅ Experience analyzing process trees, command lines, network, and filesystem signals

✅ Strong Python, PowerShell, or similar scripting

✅ Comfortable working independently on ambiguous problems.

Bonus: cloud/identity security, malware analysis, reverse engineering, MITRE ATT&CK;, OWASP LLM guidance, LLM APIs/agent frameworks, Docker/Git/CI/CD, or experience with Defender/CrowdStrike/SentinelOne/Cortex/Elastic/Splunk.

Deep prior AI-security experience is valuable but not required — if your detection engineering fundamentals are robust and you learn fast, we want to talk. Write to [email protected]

📌 AI Security Engineer - "Translate attacker tradecraft into AI-agent detections" (Bengaluru)
🏢 CareerXperts Consulting
📍 Bengaluru